From owner-freebsd-ipfw@FreeBSD.ORG Wed Sep 14 10:48:58 2011 Return-Path: <owner-freebsd-ipfw@FreeBSD.ORG> Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 9E02B1065678; Wed, 14 Sep 2011 10:48:58 +0000 (UTC) (envelope-from vladimir.budnev@gmail.com) Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by mx1.freebsd.org (Postfix) with ESMTP id 4957E8FC14; Wed, 14 Sep 2011 10:48:58 +0000 (UTC) Received: by vws5 with SMTP id 5so19159vws.17 for <multiple recipients>; Wed, 14 Sep 2011 03:48:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=Gd4C46LezxYf6lZVisMu2EjdFDRF0eqknOky66XmBvs=; b=tTY30dk1568iUR1k9AyOMlVG516th0UEiddBO0j+o1KJ8tVbL8AoTBjn4/w5j8BFuj MKJIv3FZmDa3pPDgEGvcBLOen/h5TTlCSQsjGiqsIWL/zt66wyZMw3I+nrcr8/muHd5W mnif3k7qAAxHtHBVJpaQT93Ck0iR8UgZzS2DM= MIME-Version: 1.0 Received: by 10.220.151.201 with SMTP id d9mr297672vcw.129.1315997337577; Wed, 14 Sep 2011 03:48:57 -0700 (PDT) Received: by 10.220.195.75 with HTTP; Wed, 14 Sep 2011 03:48:57 -0700 (PDT) In-Reply-To: <4E706BC1.9030203@rdtc.ru> References: <4E7066CE.3070702@gmail.com> <4E706BC1.9030203@rdtc.ru> Date: Wed, 14 Sep 2011 14:48:57 +0400 Message-ID: <CAAvRK97r0bC7KZyGeuiRQ=jG976TQAJxCSqTeDZ+TbKAXGJLqw@mail.gmail.com> From: Vladimir Budnev <vladimir.budnev@gmail.com> To: Eugene Grosbein <egrosbein@rdtc.ru> Content-Type: text/plain; charset=KOI8-R Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Cc: freebsd-net@freebsd.org, freebsd-ipfw@freebsd.org Subject: Re: IPFW hidden/broken rule? (Free 7.2) X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org> List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>, <mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe> List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw> List-Post: <mailto:freebsd-ipfw@freebsd.org> List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help> List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>, <mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe> X-List-Received-Date: Wed, 14 Sep 2011 10:48:58 -0000 > > 14.09.2011 15:33, Vladimir Budnev =D0=C9=DB=C5=D4: > > > So i think there are at least to questions: > > > > 1. Have anyone ever met such situation? Or may be something close to > > this one with 'hidden' ipfw rules? > > Have you tried "ipfw -d -e show"? > > Nope we didnt check those tables. But to be honest iI don't think there may be connection tracking issue because it is allow ip to any rule: 04701 pipe tablearg ip from table(2) to any in via em0 And I'v wrote that we can catch packets with rule, by placing it before rul= e 04701.Packets are captured by 04701 even with empty(not flushed) table 2.