Date: Thu, 13 May 2004 01:37:17 -0700 From: Luigi Rizzo <rizzo@icir.org> To: Eugene Grosbein <eugen@kuzbass.ru> Cc: net@freebsd.org Subject: Re: ipfw: reset tcp Message-ID: <20040513013717.A16394@xorpc.icir.org> In-Reply-To: <40A34082.F0182B31@kuzbass.ru>; from eugen@kuzbass.ru on Thu, May 13, 2004 at 05:31:46PM %2B0800 References: <40A3393F.1391943E@kuzbass.ru> <20040513012344.A12373@xorpc.icir.org> <40A34082.F0182B31@kuzbass.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, May 13, 2004 at 05:31:46PM +0800, Eugene Grosbein wrote:
> Luigi Rizzo wrote:
>
> > > When a rule 'reset tcp' matches, a kernel generates new TCP packet.
> > > Will it have to go through ipfw list (from the beginning or not)?
> >
> > ipfw2 uses an mbuf flag to bypass the firewall - I am not sure if i
> > only used it for the keepalives or also for TCP reset packets
>
> Please check. I suspect it does not enter ipfw itself,
yes it does skip the firewall, see ip_fw2.c:send_pkt() near the
end:
ip_rtaddr(ip->ip_dst, &sro);
---> m->m_flags |= M_SKIP_FIREWALL;
ip_output(m, NULL, &sro, 0, NULL, NULL);
removing the M_SKIP_FIREWALL would let ipfw process the
packet too. HOWEVER: i think it is a bug in the general case
to reprocess internally-generated packet, because you would rely
on a correct ipfw configuration to avoid loops (which might not
be the case).
I have no idea how ipfw1 used to do (and i am not goin to check!)
but i don't think the generated packet did reenter the firewall.
cheers
luigi
> it is not processed by my natd and bad things happen here.
>
> Eugene
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040513013717.A16394>