From owner-freebsd-net@FreeBSD.ORG  Tue Sep 13 03:52:11 2005
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
X-Original-To: freebsd-net@freebsd.org
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 35EAF16A41F
	for <freebsd-net@freebsd.org>; Tue, 13 Sep 2005 03:52:11 +0000 (GMT)
	(envelope-from on@cs.ait.ac.th)
Received: from mail.cs.ait.ac.th (mail.cs.ait.ac.th [192.41.170.16])
	by mx1.FreeBSD.org (Postfix) with ESMTP id AC0D543D45
	for <freebsd-net@freebsd.org>; Tue, 13 Sep 2005 03:52:06 +0000 (GMT)
	(envelope-from on@cs.ait.ac.th)
Received: from banyan.cs.ait.ac.th (banyan.cs.ait.ac.th [192.41.170.5])
	by mail.cs.ait.ac.th (8.12.11/8.12.11) with ESMTP id j8D3pVlr000300
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO);
	Tue, 13 Sep 2005 10:51:31 +0700 (ICT)
Received: (from on@localhost)
	by banyan.cs.ait.ac.th (8.13.1/8.12.11) id j8D2LRW7083379;
	Tue, 13 Sep 2005 09:21:27 +0700 (ICT)
Date: Tue, 13 Sep 2005 09:21:27 +0700 (ICT)
Message-Id: <200509130221.j8D2LRW7083379@banyan.cs.ait.ac.th>
From: Olivier Nicole <on@cs.ait.ac.th>
To: lists@yazzy.org
In-reply-to: <20050912131921.52d61a79.lists@yazzy.org> (message from Marcin
	Jessa on Mon, 12 Sep 2005 13:19:21 +0000)
References: <20050912131921.52d61a79.lists@yazzy.org>
X-Virus-Scanned: on CSIM by amavisd-milter (http://www.amavis.org/)
Cc: freebsd-net@freebsd.org
Subject: Re: Bridging and divert
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 13 Sep 2005 03:52:11 -0000

> Is there a trick to make bridge work with divert ?

I use ipf not ipfw. Divert I think is same as redirection. What I
found out is:

1) firewall applies only to incoming packets (while I think it should
   apply to incoming and outgoing) so only half the rules applies, and
   the revert rule of an a redirection will never apply.

2) the IP packet is modified OK, but the Ethernet frame that encl;ose
   the packet is not modified, so whatever the IP says, the packet
   will be delivered to the same old MAC address.

> Is something like thay maybe possible with pf or ipf ?

Modify /sys/net/bridge.c (good luck!)

Olivier