From owner-freebsd-net  Tue Feb  6 10:30:20 2001
Delivered-To: freebsd-net@freebsd.org
Received: from fw.wintelcom.net (ns1.wintelcom.net [209.1.153.20])
	by hub.freebsd.org (Postfix) with ESMTP id 67FBF37B401
	for <net@freebsd.org>; Tue,  6 Feb 2001 10:30:02 -0800 (PST)
Received: (from bright@localhost)
	by fw.wintelcom.net (8.10.0/8.10.0) id f16ITwD16942;
	Tue, 6 Feb 2001 10:29:58 -0800 (PST)
Date: Tue, 6 Feb 2001 10:29:58 -0800
From: Alfred Perlstein <bright@wintelcom.net>
To: Luigi Rizzo <rizzo@aciri.org>
Cc: net@freebsd.org
Subject: IPFIREWALL + BRIDGE + IPDIVERT doesn't work?
Message-ID: <20010206102958.N26076@fw.wintelcom.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
Sender: owner-freebsd-net@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

Let me apologize in advance for this shoddyish bug report.

In a recent -stable (since the new ipfw fixes) if you build
a kernel with options:

IPFIREWALL
IPFIREWALL_VERBOSE
IPFIREWALL_DEFAULT_TO_ACCEPT
IPDIVERT
BRIDGE
DUMMYNET

You wind up with a kernel that doesn't grok the ipfw 'via' keyword.

Basically any rule that has a 'via' in it makes the userland ipfw
tool get a 'invalid setsockopt'.  Anyone booting a kernel on a
system that relies on 'via' keywords is in for a big suprise as
all those rules won't load.

-- 
-Alfred Perlstein - [bright@wintelcom.net|alfred@freebsd.org]
"I have the heart of a child; I keep it in a jar on my desk."


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-net" in the body of the message