From owner-freebsd-ipfw@FreeBSD.ORG  Thu May 13 01:55:23 2004
Return-Path: <owner-freebsd-ipfw@FreeBSD.ORG>
Delivered-To: freebsd-ipfw@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 7D9BF16A4F9; Thu, 13 May 2004 01:55:23 -0700 (PDT)
Received: from www.svzserv.kemerovo.su (www.svzserv.kemerovo.su
	[213.184.65.80])	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 08A3343D2F; Thu, 13 May 2004 01:55:22 -0700 (PDT)
	(envelope-from eugen@kuzbass.ru)
Received: from kuzbass.ru (kost [213.184.65.82])i4D8tKIE000179;
	Thu, 13 May 2004 16:55:20 +0800 (KRAST)
	(envelope-from eugen@kuzbass.ru)
Message-ID: <40A345F9.1460F5C4@kuzbass.ru>
Date: Thu, 13 May 2004 17:55:05 +0800
From: Eugene Grosbein <eugen@kuzbass.ru>
Organization: SVZServ
X-Mailer: Mozilla 4.8 [en] (Win98; U)
X-Accept-Language: ru,en
MIME-Version: 1.0
To: Luigi Rizzo <rizzo@icir.org>
References: <40A3393F.1391943E@kuzbass.ru>
	<20040513012344.A12373@xorpc.icir.org> <40A34082.F0182B31@kuzbass.ru>
	<20040513013717.A16394@xorpc.icir.org>
Content-Type: text/plain; charset=koi8-r
Content-Transfer-Encoding: 7bit
cc: ipfw@freebsd.org
cc: net@freebsd.org
Subject: Re: ipfw: reset tcp
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 13 May 2004 08:55:23 -0000

Luigi Rizzo wrote:

> > Please check. I suspect it does not enter ipfw itself,
> 
> yes it does skip the firewall, see ip_fw2.c:send_pkt() near the
> end:
> 
>         ip_rtaddr(ip->ip_dst, &sro);
> --->    m->m_flags |= M_SKIP_FIREWALL;
>         ip_output(m, NULL, &sro, 0, NULL, NULL);
> 
> removing the M_SKIP_FIREWALL would let ipfw process the
> packet too. HOWEVER: i think it is a bug in the general case
> to reprocess internally-generated packet, because you would rely
> on a correct ipfw configuration to avoid loops (which might not
> be the case).
> 
> I have no idea how ipfw1 used to do (and i am not goin to check!)
> but i don't think the generated packet did reenter the firewall.

I use ipfw2.

Please make it possible (using sysctl or any other mean) to
disable M_SKIP_FIREWALL for such packets (I suppose 'unreach' rules
are affected too). I DO need to process ALL outgoing packets.
For exapmle, I must use 'ipfw fwd' (to implement policy routing)
for the packets with source IP like this.

Eugene