From owner-freebsd-questions  Fri Oct 12 18:49:50 2001
Delivered-To: freebsd-questions@freebsd.org
Received: from robin.mail.pas.earthlink.net (robin.mail.pas.earthlink.net [207.217.120.65])
	by hub.freebsd.org (Postfix) with ESMTP
	id 8C2D637B405; Fri, 12 Oct 2001 18:49:41 -0700 (PDT)
Received: from blossom.cjclark.org (dialup-209.245.143.238.Dial1.SanJose1.Level3.net [209.245.143.238])
	by robin.mail.pas.earthlink.net (8.11.5/8.9.3) with ESMTP id f9D1mwT17194;
	Fri, 12 Oct 2001 18:49:02 -0700 (PDT)
Received: (from cjc@localhost)
	by blossom.cjclark.org (8.11.6/8.11.3) id f9D1lop06937;
	Fri, 12 Oct 2001 18:47:50 -0700 (PDT)
	(envelope-from cjc)
Date: Fri, 12 Oct 2001 18:47:41 -0700
From: "Crist J. Clark" <cristjc@earthlink.net>
To: Henrik Holmstam <turbo@lamering.org>
Cc: Kenneth Wayne Culver <culverk@wam.umd.edu>,
	Alfatrion <alfatrion@cybertron.tmfweb.nl>,
	"Maine LOA List Admin (Brent Bailey)" <brentb@loa.com>,
	"Hartmann, O." <ohartman@klima.physik.uni-mainz.de>,
	freebsd-stable@FreeBSD.ORG, freebsd-questions@FreeBSD.ORG
Subject: Re: IPFW or IPFILTER?
Message-ID: <20011012184741.D6274@blossom.cjclark.org>
Reply-To: cjclark@alum.mit.edu
References: <Pine.GSO.4.21.0110121216390.27495-100000@sun10pg2.wam.umd.edu> <20011012185458.K69352-100000@darkwing.turbo.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <20011012185458.K69352-100000@darkwing.turbo.net>; from turbo@lamering.org on Fri, Oct 12, 2001 at 06:56:48PM +0200
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

On Fri, Oct 12, 2001 at 06:56:48PM +0200, Henrik Holmstam wrote:
> 
> Can IPFW keep state on UDP and ICMP as IPFilter can?

Yes and kinda.

"Keeping state" on UDP (a stateless protocol, BTW) is pretty easy. You
see a packet,

  <src_ip>:<src_port> -> <dst_ip>:<dst_port>

So you then allow,

  <dst_ip>:<dst_port> -> <src_ip>:<src_port>

To go through for a while. ipfw(8) dynamic rules will handle this just
fine.

ICMP is another issue. Doing something like,

  pass icmp from any to any out via <external_if> keep-state

Will let you ping the rest of the word and even let Windows-style
traceroutes work, but that's because it works like this:

  <src_ip>:<src_icmp_type.src_icmp_code> -> <dst_ip>

Creates a dynamic rule,

  pass icmp from <dst_ip> to <src_ip>

That is, _any_ ICMP from <dst_ip> to <src_ip> is passed for the
dynamic's rule lifetime.
-- 
Crist J. Clark                     |     cjclark@alum.mit.edu
                                   |     cjclark@jhu.edu
http://people.freebsd.org/~cjc/    |     cjc@freebsd.org

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message