From owner-freebsd-questions@FreeBSD.ORG Fri Jul 22 07:26:46 2005 Return-Path: X-Original-To: questions@freebsd.org Delivered-To: freebsd-questions@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 79E6216A420 for ; Fri, 22 Jul 2005 07:26:46 +0000 (GMT) (envelope-from gouders@et.bocholt.fh-gelsenkirchen.de) Received: from alice.et.bocholt.fh-gelsenkirchen.de (alice.et.bocholt.fh-gelsenkirchen.de [193.175.197.63]) by mx1.FreeBSD.org (Postfix) with ESMTP id D2F8643D49 for ; Fri, 22 Jul 2005 07:26:45 +0000 (GMT) (envelope-from gouders@et.bocholt.fh-gelsenkirchen.de) Received: from musashi.et.bocholt.fh-gelsenkirchen.de (musashi.et.bocholt.fh-gelsenkirchen.de [193.175.197.95]) by alice.et.bocholt.fh-gelsenkirchen.de (8.12.9/8.12.9) with ESMTP id j6M7QfeD014098 (version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=NO) for ; Fri, 22 Jul 2005 09:26:42 +0200 Received: from localhost (localhost [127.0.0.1]) by musashi.et.bocholt.fh-gelsenkirchen.de (8.13.3/8.13.3) with ESMTP id j6M7Qfw3075675 for ; Fri, 22 Jul 2005 09:26:41 +0200 (CEST) (envelope-from hank@musashi.et.bocholt.fh-gelsenkirchen.de) Message-Id: <200507220726.j6M7Qfw3075675@musashi.et.bocholt.fh-gelsenkirchen.de> To: questions@freebsd.org In-Reply-To: Message from Kevin Kinsey of "Thu, 21 Jul 2005 19:22:41 CDT." <20050722002241.GA94174@ezekiel.daleco.biz> Date: Fri, 22 Jul 2005 09:26:41 +0200 From: Dirk GOUDERS X-Scanned-By: MIMEDefang 2.43 Cc: Subject: Re: ipfw and tun0 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jul 2005 07:26:46 -0000 > >I just started to use an ADSL line with PPPoE and want run a firewall > >between it and my local network. What I am wondering about is that > >even if I only have the default everything-blocking rule (deny ip from > >any to any) I still see incoming packets on tun0 with tcpdump. > > > >Is this, because the firewall rules get checked after the packets > >leave the tun0 interface? On what interface should I run tcpdump then > >to check if my rules are working as expected? > > Just a guess, here .... tun0 doesn't exist when the firewall rc > script is run, so you may have to explicity state the name > of the interface since it wouldn't be listed during device > polling at boot time? Well, it seems as if my firewall rules work as expected -- with just the default rule, I cannot do anything on the net. Another example is that I saw several SYN packets directed to unprivileged ports that got answered with a RST packet by my machine. When I block those SYN packets, I still see them on tun0 but the RST responses disappear. Also, ipfw's counters show that it recognizes those packets... Sorry for not mentioning that earlier. Dirk