From owner-freebsd-net@FreeBSD.ORG  Wed Sep 14 10:48:58 2011
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 9E02B1065678;
	Wed, 14 Sep 2011 10:48:58 +0000 (UTC)
	(envelope-from vladimir.budnev@gmail.com)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com
	[209.85.212.44])
	by mx1.freebsd.org (Postfix) with ESMTP id 4957E8FC14;
	Wed, 14 Sep 2011 10:48:58 +0000 (UTC)
Received: by vws5 with SMTP id 5so19159vws.17
	for <multiple recipients>; Wed, 14 Sep 2011 03:48:57 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma;
	h=mime-version:in-reply-to:references:date:message-id:subject:from:to
	:cc:content-type;
	bh=Gd4C46LezxYf6lZVisMu2EjdFDRF0eqknOky66XmBvs=;
	b=tTY30dk1568iUR1k9AyOMlVG516th0UEiddBO0j+o1KJ8tVbL8AoTBjn4/w5j8BFuj
	MKJIv3FZmDa3pPDgEGvcBLOen/h5TTlCSQsjGiqsIWL/zt66wyZMw3I+nrcr8/muHd5W
	mnif3k7qAAxHtHBVJpaQT93Ck0iR8UgZzS2DM=
MIME-Version: 1.0
Received: by 10.220.151.201 with SMTP id d9mr297672vcw.129.1315997337577; Wed,
	14 Sep 2011 03:48:57 -0700 (PDT)
Received: by 10.220.195.75 with HTTP; Wed, 14 Sep 2011 03:48:57 -0700 (PDT)
In-Reply-To: <4E706BC1.9030203@rdtc.ru>
References: <4E7066CE.3070702@gmail.com>
	<4E706BC1.9030203@rdtc.ru>
Date: Wed, 14 Sep 2011 14:48:57 +0400
Message-ID: <CAAvRK97r0bC7KZyGeuiRQ=jG976TQAJxCSqTeDZ+TbKAXGJLqw@mail.gmail.com>
From: Vladimir Budnev <vladimir.budnev@gmail.com>
To: Eugene Grosbein <egrosbein@rdtc.ru>
Content-Type: text/plain; charset=KOI8-R
Content-Transfer-Encoding: quoted-printable
X-Content-Filtered-By: Mailman/MimeDel 2.1.5
Cc: freebsd-net@freebsd.org, freebsd-ipfw@freebsd.org
Subject: Re: IPFW hidden/broken rule? (Free 7.2)
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 14 Sep 2011 10:48:58 -0000

>
> 14.09.2011 15:33, Vladimir Budnev =D0=C9=DB=C5=D4:
>
> > So i think there are at least to questions:
> >
> > 1. Have anyone ever met such situation? Or may be something close to
> > this one with 'hidden' ipfw rules?
>
> Have you tried "ipfw -d -e show"?
>
>
Nope we didnt check those tables. But to be honest iI don't think there may
be connection tracking issue because it is allow ip to any rule:
04701 pipe tablearg ip from table(2) to any in via em0

And I'v wrote that we can catch packets with rule, by placing it before rul=
e
04701.Packets are captured by 04701 even with empty(not flushed) table 2.