Date: Mon, 15 Jul 2002 18:12:25 +0400 From: "Dmitry S. Rzhavin" <dima@rt.ru> To: security@FreeBSD.ORG Subject: ipfw and keep-state Message-ID: <3D32D849.E3D8F2BE@rt.ru>
next in thread | raw e-mail | index | archive | help
Hello!
I'm trying to set up a stateful firewall using ipfw.
And I noticed one strange (to me) thing: I create
rules like this:
sample net:
inet
|
-----------
| FreeBSD |
-----------
|
----ip1----
|some host|
-----------
sample IPFW rules:
10 pass tcp from any to ip2 in keep-state setup
... nothing interesting here
20 deny tcp from any to ip2
Or, in other words, I want to pre-auth some packet with rile 10 to
check it later. Then, I decide to drop it.
But ipfw creates dynamic rule "inet <-> ip1" and passes this
session. I think this is not good. Why does ipfw works this way?
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3D32D849.E3D8F2BE>