From owner-freebsd-net@FreeBSD.ORG Wed Mar 19 20:47:36 2008 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 84695106566C for ; Wed, 19 Mar 2008 20:47:36 +0000 (UTC) (envelope-from fjwcash@gmail.com) Received: from smtp.sd73.bc.ca (smtp.sd73.bc.ca [142.24.13.140]) by mx1.freebsd.org (Postfix) with ESMTP id 5F1B98FC1A for ; Wed, 19 Mar 2008 20:47:36 +0000 (UTC) (envelope-from fjwcash@gmail.com) Received: from localhost (localhost [127.0.0.1]) by localhost.sd73.bc.ca (Postfix) with ESMTP id A20FC1A000B14 for ; Wed, 19 Mar 2008 13:47:35 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at smtp.sd73.bc.ca Received: from smtp.sd73.bc.ca ([127.0.0.1]) by localhost (smtp.sd73.bc.ca [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 8iMOGlamzWoC for ; Wed, 19 Mar 2008 13:47:29 -0700 (PDT) Received: from coal.local (s10.sbo [192.168.0.10]) by smtp.sd73.bc.ca (Postfix) with ESMTP id 25A521A000B16 for ; Wed, 19 Mar 2008 13:47:29 -0700 (PDT) From: Freddie Cash Organization: School District 73 To: freebsd-net@freebsd.org Date: Wed, 19 Mar 2008 13:47:28 -0700 User-Agent: KMail/1.9.7 References: <200803191334.54510.fjwcash@gmail.com> <200803191343.45516.fjwcash@gmail.com> In-Reply-To: <200803191343.45516.fjwcash@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200803191347.28329.fjwcash@gmail.com> Subject: Re: "established" on { tcp or udp } rules X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Mar 2008 20:47:36 -0000 On March 19, 2008 01:43 pm Freddie Cash wrote: > On March 19, 2008 01:34 pm Freddie Cash wrote: > > Just curious if the following rule will work correctly. It is > > accepted by the ipfw command. In the process of working out a test > > for it, but thought I'd ask here as well, just to be sure. > > > > ipfw add { tcp or udp } from me to any 53 out xmit fxp0 > > ipfw add { tcp or udp } from any 53 to me in recv fxp0 > > established > > > > Will the UDP packets go through correctly, even though "established" > > has no meaning for UDP streams, and the ipfw command will barf if you > > use it with just "ipfw add udp" rules? > > Hmm, from the looks of things, it doesn't work. Even though it > specifies both tcp and udp, the rule only matches tcp packets from an > established connection. > > Perhaps a warning or error should be given when you try to use TCP > options on rules that aren't TCP-specific? > > Or am I missing something here? Guess I should probably have included a test case. From "ipfw show" output: 00100 3 162 allow { tcp or udp } from me to any dst-port 53 out xmit fxp0 00110 0 0 allow { tcp or udp } from any 53 to me in recv fxp0 established 00120 3 409 allow { tcp or udp } from any 53 to me in recv fxp0 Without a "deny ip from any to any" rule instead of the last rule, UDP DNS requests fail. -- Freddie Cash fjwcash@gmail.com