From owner-freebsd-security Mon Jul 15 7:13:57 2002 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2B3BC37B407 for ; Mon, 15 Jul 2002 07:13:54 -0700 (PDT) Received: from balrog.rt.ru (balrog.rt.ru [217.107.221.3]) by mx1.FreeBSD.org (Postfix) with ESMTP id C3C2443E42 for ; Mon, 15 Jul 2002 07:13:52 -0700 (PDT) (envelope-from dima@rt.ru) Received: from rt.ru (localhost [127.0.0.1]) by balrog.rt.ru (8.9.3/8.9.3) with ESMTP id SAA14409 for ; Mon, 15 Jul 2002 18:12:25 +0400 (MSD) (envelope-from dima@rt.ru) Message-ID: <3D32D849.E3D8F2BE@rt.ru> Date: Mon, 15 Jul 2002 18:12:25 +0400 From: "Dmitry S. Rzhavin" Organization: Rostelecom X-Mailer: Mozilla 4.7 [en] (X11; I; FreeBSD 4.0-20000103-CURRENT i386) X-Accept-Language: ru, en MIME-Version: 1.0 To: security@FreeBSD.ORG Subject: ipfw and keep-state Content-Type: text/plain; charset=koi8-r Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Hello! I'm trying to set up a stateful firewall using ipfw. And I noticed one strange (to me) thing: I create rules like this: sample net: inet | ----------- | FreeBSD | ----------- | ----ip1---- |some host| ----------- sample IPFW rules: 10 pass tcp from any to ip2 in keep-state setup ... nothing interesting here 20 deny tcp from any to ip2 Or, in other words, I want to pre-auth some packet with rile 10 to check it later. Then, I decide to drop it. But ipfw creates dynamic rule "inet <-> ip1" and passes this session. I think this is not good. Why does ipfw works this way? To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message