Date: Thu, 13 May 2004 17:55:05 +0800 From: Eugene Grosbein <eugen@kuzbass.ru> To: Luigi Rizzo <rizzo@icir.org> Cc: net@freebsd.org Subject: Re: ipfw: reset tcp Message-ID: <40A345F9.1460F5C4@kuzbass.ru> References: <40A3393F.1391943E@kuzbass.ru> <20040513012344.A12373@xorpc.icir.org> <40A34082.F0182B31@kuzbass.ru> <20040513013717.A16394@xorpc.icir.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Luigi Rizzo wrote: > > Please check. I suspect it does not enter ipfw itself, > > yes it does skip the firewall, see ip_fw2.c:send_pkt() near the > end: > > ip_rtaddr(ip->ip_dst, &sro); > ---> m->m_flags |= M_SKIP_FIREWALL; > ip_output(m, NULL, &sro, 0, NULL, NULL); > > removing the M_SKIP_FIREWALL would let ipfw process the > packet too. HOWEVER: i think it is a bug in the general case > to reprocess internally-generated packet, because you would rely > on a correct ipfw configuration to avoid loops (which might not > be the case). > > I have no idea how ipfw1 used to do (and i am not goin to check!) > but i don't think the generated packet did reenter the firewall. I use ipfw2. Please make it possible (using sysctl or any other mean) to disable M_SKIP_FIREWALL for such packets (I suppose 'unreach' rules are affected too). I DO need to process ALL outgoing packets. For exapmle, I must use 'ipfw fwd' (to implement policy routing) for the packets with source IP like this. Eugene
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?40A345F9.1460F5C4>