Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 6 Feb 2001 13:01:25 -0800 (PST)
From:      Luigi Rizzo <rizzo@aciri.org>
To:        bright@wintelcom.net (Alfred Perlstein)
Cc:        rizzo@aciri.org, net@freebsd.org
Subject:   Re: IPFIREWALL + BRIDGE + IPDIVERT doesn't work?
Message-ID:  <200102062101.f16L1PI44593@iguana.aciri.org>
In-Reply-To: <20010206104553.P26076@fw.wintelcom.net> from Alfred Perlstein at "Feb 6, 2001 10:45:53 am"

next in thread | previous in thread | raw e-mail | index | archive | help
well i just tested things here and everything works fine.
"via" rules are accepted. i have the same set of options
that you mentioned IPFW DIVERT open firewall dummynet and bridge.

This is on an essentially up-to-date STABLE (net/ and netinet/
are same as in -stable).

	cheers
	luigi

> * Luigi Rizzo <rizzo@aciri.org> [010206 10:41] wrote:
> > i assume you have upgraded the .h files in
> > /usr/include/net and /usr/include/netinet and recompiled
> > the userland ipfw, right ?
> 
> Yes, buildworld/installworld was done.
> 
> > your report is kind of strange because none of the recent
> > changes (unless you mean the tcp security fixes) involves
> > additional specifiers in ipfw rules.
> 
> This is post-security fixes.
> 
> > Sure the ipfw struct and the pipe descriptor have changed size,
> > but then the problem would occur for all rules not just the "via"
> > ones.
> 
> I thought so as well, but simple rules without via work...
> 
> > can you give use some more detail ?
> 
> Yea, I'll try, it would be helpful if you could try to boot a kernel
> with all those options just to make sure it's not just me.
> 
> -Alfred
> 
> > > Let me apologize in advance for this shoddyish bug report.
> > > 
> > > In a recent -stable (since the new ipfw fixes) if you build
> > > a kernel with options:
> > > 
> > > IPFIREWALL
> > > IPFIREWALL_VERBOSE
> > > IPFIREWALL_DEFAULT_TO_ACCEPT
> > > IPDIVERT
> > > BRIDGE
> > > DUMMYNET
> > > 
> > > You wind up with a kernel that doesn't grok the ipfw 'via' keyword.
> > > 
> > > Basically any rule that has a 'via' in it makes the userland ipfw
> > > tool get a 'invalid setsockopt'.  Anyone booting a kernel on a
> > > system that relies on 'via' keywords is in for a big suprise as
> > > all those rules won't load.
> 



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-net" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200102062101.f16L1PI44593>