From owner-freebsd-questions@FreeBSD.ORG Fri Mar 10 04:44:52 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E8EE216A420 for ; Fri, 10 Mar 2006 04:44:52 +0000 (GMT) (envelope-from mefystofel@gmail.com) Received: from wproxy.gmail.com (wproxy.gmail.com [64.233.184.196]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5695843D6D for ; Fri, 10 Mar 2006 04:44:48 +0000 (GMT) (envelope-from mefystofel@gmail.com) Received: by wproxy.gmail.com with SMTP id i22so577232wra for ; Thu, 09 Mar 2006 20:44:47 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=ncKMLFy6erJKdr4NSnu0+rH3vzMI16q8G3UQJVgjv2moquOrIppEcN3zFkRLu3a59+JQBrs5KYA45tZXfKDaoIw38oEegORPtskwFB6vJ0VGiCfOYXaKbfFnGVcfeaemdEzLeH83wkKs68sCa2DurQuIC7R25v8hhoyBvOjJtgI= Received: by 10.54.70.8 with SMTP id s8mr538100wra; Thu, 09 Mar 2006 20:44:47 -0800 (PST) Received: by 10.54.93.14 with HTTP; Thu, 9 Mar 2006 20:44:47 -0800 (PST) Message-ID: Date: Fri, 10 Mar 2006 09:44:47 +0500 From: "Roman Serbski" To: freebsd-questions@freebsd.org In-Reply-To: <440C25FE.6050401@locolomo.org> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Content-Disposition: inline References: <4402232A.8010908@locolomo.org> <44031DC4.6060804@locolomo.org> <440C25FE.6050401@locolomo.org> Cc: Subject: Re: Help with IP Filter 4.1.8 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2006 04:44:53 -0000 Hello Erik. Thank you for your help. > Ok, here are some things to try: > > 1) Other udp services, are responces also blocked? you can for example > try ntp. If so, then it is likely a bug in ip-filter. Yes. Same for other udp (I tested with ntp). The symptoms are the same - there is a hit on a rule allowing outgoing ntp, but then reply is blocked. > 2) Try using snort or tcpdump to capture the blocked packet and analyse > if it is malformed. Possibly include such a packet with your next post. I can collect tcpdump data only if I disable ipf or configure it to 'pass in/out all'. If I turn on my ruleset I don't see any data from tcpdump. Running 'tcpdump -vvv -i xl0' generates a message that tcpdump is listening on xl0 but no data is captured... > 3) try to see if you can upgrade to a newer ipfilter, latest is v4.1.10 I will try that, although I have faced with the problem while upgrading to v4.1.10. According to ipf docs (INSTALL.FreeBSD): To build a kernel with the IP filter, follow these steps: make freebsd5 - went successfully make install-bsd - went successfully FreeBSD/kinstall - generated patch error about conf.c file not being found.= .. Thank you. Roman