Date: Tue, 6 Feb 2001 13:01:25 -0800 (PST) From: Luigi Rizzo <rizzo@aciri.org> To: bright@wintelcom.net (Alfred Perlstein) Cc: rizzo@aciri.org, net@freebsd.org Subject: Re: IPFIREWALL + BRIDGE + IPDIVERT doesn't work? Message-ID: <200102062101.f16L1PI44593@iguana.aciri.org> In-Reply-To: <20010206104553.P26076@fw.wintelcom.net> from Alfred Perlstein at "Feb 6, 2001 10:45:53 am"
next in thread | previous in thread | raw e-mail | index | archive | help
well i just tested things here and everything works fine. "via" rules are accepted. i have the same set of options that you mentioned IPFW DIVERT open firewall dummynet and bridge. This is on an essentially up-to-date STABLE (net/ and netinet/ are same as in -stable). cheers luigi > * Luigi Rizzo <rizzo@aciri.org> [010206 10:41] wrote: > > i assume you have upgraded the .h files in > > /usr/include/net and /usr/include/netinet and recompiled > > the userland ipfw, right ? > > Yes, buildworld/installworld was done. > > > your report is kind of strange because none of the recent > > changes (unless you mean the tcp security fixes) involves > > additional specifiers in ipfw rules. > > This is post-security fixes. > > > Sure the ipfw struct and the pipe descriptor have changed size, > > but then the problem would occur for all rules not just the "via" > > ones. > > I thought so as well, but simple rules without via work... > > > can you give use some more detail ? > > Yea, I'll try, it would be helpful if you could try to boot a kernel > with all those options just to make sure it's not just me. > > -Alfred > > > > Let me apologize in advance for this shoddyish bug report. > > > > > > In a recent -stable (since the new ipfw fixes) if you build > > > a kernel with options: > > > > > > IPFIREWALL > > > IPFIREWALL_VERBOSE > > > IPFIREWALL_DEFAULT_TO_ACCEPT > > > IPDIVERT > > > BRIDGE > > > DUMMYNET > > > > > > You wind up with a kernel that doesn't grok the ipfw 'via' keyword. > > > > > > Basically any rule that has a 'via' in it makes the userland ipfw > > > tool get a 'invalid setsockopt'. Anyone booting a kernel on a > > > system that relies on 'via' keywords is in for a big suprise as > > > all those rules won't load. > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200102062101.f16L1PI44593>