From owner-freebsd-ipfw Mon Aug 5 11: 5:50 2002 Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0BD9037B400; Mon, 5 Aug 2002 11:05:47 -0700 (PDT) Received: from sccrmhc02.attbi.com (sccrmhc02.attbi.com [204.127.202.62]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3C22843E4A; Mon, 5 Aug 2002 11:05:46 -0700 (PDT) (envelope-from crist.clark@attbi.com) Received: from blossom.cjclark.org ([12.234.91.48]) by sccrmhc02.attbi.com (InterMail vM.4.01.03.27 201-229-121-127-20010626) with ESMTP id <20020805180545.DIQ221.sccrmhc02.attbi.com@blossom.cjclark.org>; Mon, 5 Aug 2002 18:05:45 +0000 Received: from blossom.cjclark.org (localhost. [127.0.0.1]) by blossom.cjclark.org (8.12.3/8.12.3) with ESMTP id g75I5iJK063301; Mon, 5 Aug 2002 11:05:44 -0700 (PDT) (envelope-from crist.clark@attbi.com) Received: (from cjc@localhost) by blossom.cjclark.org (8.12.3/8.12.3/Submit) id g75I5ahQ063300; Mon, 5 Aug 2002 11:05:36 -0700 (PDT) X-Authentication-Warning: blossom.cjclark.org: cjc set sender to crist.clark@attbi.com using -f Date: Mon, 5 Aug 2002 11:05:36 -0700 From: "Crist J. Clark" To: Nick Rogness Cc: Joe & Fhe Barbish , FBIPFW , archie@whistle.com, cmott@scientech.com, perhaps@yes.no, suutari@iki.fi, dnelson@redwoodsoft.com, brian@awfulhak.org, ru@FreeBSD.ORG, rizzo@icir.org Subject: Re: natd & keep-state Message-ID: <20020805180536.GA63145@blossom.cjclark.org> Reply-To: cjclark@alum.mit.edu References: <20020803212854.GA55652@blossom.cjclark.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4i X-URL: http://people.freebsd.org/~cjc/ Sender: owner-freebsd-ipfw@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Sat, Aug 03, 2002 at 08:53:10PM -0500, Nick Rogness wrote: > On Sat, 3 Aug 2002, Crist J. Clark wrote: > > [SNIP] > > Fine, whatever. But the ipfw(8) and natd(8) developers seem to hold > > the same opinion. Maybe if you proposed some possible way for natd(8) > > and 'keep-state' rules to work well together someone could do it. > > FWIW, you can modify the behavior of "check-state" to "JUMP TO > RULE NUMBER XXX on stateful match" and solve most of the problems > associated with natd & stateful inspection. Right now, > if check-state finds a match it stops...we need it to optionally > JUMP_TO RULE XXX. Kinda like "skipto" functionality. > > I talked to Luigi about this and he didn't understand what I > meant (which is my fault). But I believe the concept is still > sound. Well, I'm not sure I understand exactly what you mean either, but I would note, ipfw 1000 add skipto 5000 ip from $src to $dst keep-state _Does_ work. 'keep-state' rules need not be only 'pass' actions. I just tested to make sure. I started with the ruleset, 00100 0 0 skipto 2000 tcp from 192.168.64.70 to me keep-state 01000 34 4158 allow ip from any to any 02000 0 0 allow ip from any to any 65535 0 0 deny ip from any to any And started a TCP connection, 00100 18 3895 skipto 2000 tcp from 192.168.64.70 to me keep-state 01000 54 5362 allow ip from any to any 02000 18 3895 allow ip from any to any 65535 0 0 deny ip from any to any Then I added some rules to make sure that it was really working, and after passing some more data over the existing channel, 00090 0 0 check-state 00095 0 0 allow ip from me to 192.168.64.70 00096 0 0 allow ip from 192.168.64.70 to me 00100 141 15076 skipto 2000 tcp from 192.168.64.70 to me keep-state 01000 877 89158 allow ip from any to any 02000 141 15076 allow ip from any to any 65535 0 0 deny ip from any to any Notice that rules 95 and 96 do not get hit. The 'skipto' is being done at the 'check-state' rule. -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message