From owner-freebsd-questions@FreeBSD.ORG Mon Aug 19 19:36:25 2013 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id B9266ABE for ; Mon, 19 Aug 2013 19:36:25 +0000 (UTC) (envelope-from lists.dan@gmail.com) Received: from mail-qa0-x231.google.com (mail-qa0-x231.google.com [IPv6:2607:f8b0:400d:c00::231]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 7E7C5240D for ; Mon, 19 Aug 2013 19:36:25 +0000 (UTC) Received: by mail-qa0-f49.google.com with SMTP id cr7so2075206qab.15 for ; Mon, 19 Aug 2013 12:36:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=K76YgrUXldFX0qq28UnbLPmQCZzOtknl/hAk9i3pRNA=; b=eyq/OOjvd/vVXple14eiYUwrcbeI4CsDHUjilY/Xfo0ncGpWejrrE54oVGMUmdlsQt TfEK6JrJUbKwk/3EQK2BDDS4uzjKlFnFDelfRC4Ank0bA0571HdXslQq16+hYzMzzn8k u2dHnfSU68rOcjADU19bOL/VSelooPJHw6Kg4RnD6ptI2ghAdIjZhrX4qEbwaOmRw6p6 G89h2xRaGM4RBAv3L+/sd7FpiAFXFL+J1AHsMwtTCO/IwuEGZJ+3BJtNJG/DMfTxqHhM rTm/EqUcjnKEsljtHousscDWcdyqcCaSr7EbtmqjCiEuM/YfyzSkRG40aQSQI4tyZB8p Ng6Q== MIME-Version: 1.0 X-Received: by 10.224.69.129 with SMTP id z1mr4667099qai.88.1376940984702; Mon, 19 Aug 2013 12:36:24 -0700 (PDT) Received: by 10.224.218.134 with HTTP; Mon, 19 Aug 2013 12:36:24 -0700 (PDT) In-Reply-To: <5211B5E1.6040000@blackfoot.net> References: <5211B5E1.6040000@blackfoot.net> Date: Mon, 19 Aug 2013 14:36:24 -0500 Message-ID: Subject: Re: ipfw confusion From: Dan Lists To: Gary Aitken Content-Type: text/plain; charset=ISO-8859-1 X-Content-Filtered-By: Mailman/MimeDel 2.1.14 Cc: FreeBSD Mailing List X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2013 19:36:25 -0000 On Mon, Aug 19, 2013 at 1:06 AM, Gary Aitken wrote: > > ipfw list > ... > 21109 allow tcp from any to 12.32.44.142 dst-port 53 in via tun0 setup > keep-state > 21129 allow tcp from any to 12.32.36.65 dst-port 53 in via tun0 setup > keep-state > ... > 65534 deny log logamount 5 ip from any to any > > What am I missing? > > Do you have a check-state rule earlier in your rules? 1000 check-state Dan