Date: Thu, 5 Dec 2002 00:55:12 -0500 From: "Ilya" <mail@krel.org> To: <freebsd-ipfw@freebsd.org> Subject: ipfw2 crashes Message-ID: <00d701c29c22$e04bcb80$0100a8c0@ilya> References: <3DEE16D7.1020706@northnetworks.ca> <3DEE39C3.5040704@northnetworks.ca> <000901c29bbb$7bb4a0a0$4635a8c0@sloniki> <3DEE6D69.1080504@northnetworks.ca>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
I have tried ipfw2 and it core dumps on my box.
i saw these errors during boot:
ipfw: size mismatch (have 176 want 16420)
ipfw: size mismatch (have 176 want 48)
ipfw: size mismatch (have 176 want 48)
ipfw: size mismatch (have 176 want 48)
ipfw: size mismatch (have 176 want 48)
ipfw: size mismatch (have 176 want 48)
ipfw: size mismatch (have 176 want 48)
i cant gdb the core file, so it is attached (its very small), hope it will
help.
4.7 stable
here is the ruleset:
#Flush rules
ipfw -f flush
ipfw -f zero
ipfw -f resetlog
#Natd
ipfw add divert natd all from any to any via $DIF
ipfw add check-state
# Allow any traffic from local network to any passing through the
# internal interface
ipfw add allow ip from $LAN to any keep-state via $LIF
ipfw add allow ip from $LAN to any keep-state via $LIF
#ipfw add allow ip from $LAN to any via $LIF
ipfw add allow ip from $ALCHEMISTRY to any keep-state via $DIF
ipfw add allow ip from $IPC to any keep-state via $CIF
#Allow incoming requests to reach the following services:
ipfw add allow tcp from any to $ALCHEMISTRY 22,25,80 setup keep-state via
$DIF
ipfw add check-state
# Allow DNS traffic from internet to query your DNS (for reverse
# lookups etc).
ipfw add allow udp from any 53 to $ALCHEMISTRY 53 via $DIF
ipfw add allow udp from any 1024-65535 to $ALCHEMISTRY 53 via $DIF
ipfw add allow udp from any 53 to $RUMATA 53 via $DIF
ipfw add allow udp from any 1024-65535 to $RUMATA 53 via $DIF
ipfw add allow udp from any 53 to $ALCHEMISTRY 1024-65535 via $DIF
ipfw add allow udp from any 53 to $RUMATA 1024-65535 via $DIF
# Allow required ICMP
ipfw add allow icmp from any to any icmptypes 3,4,11,12
#httptunel from work
#ipfw add allow tcp from any to $RUMATA 443 setup via $DIF
#LOCAL
ipfw add pass all from any to any via lo0
ipfw add deny log all from any to 127.0.0.0/8
#ipfw add deny log tcp from any to any in via fxp0 established
#ipfw add deny log ip from any to any in recv fxp0 frag
#ipfw add deny log ip from $LAN to any in via $CIF
#ipfw add deny log ip from $LAN to any in via $DIF
#ipfw add deny log ip from not $LAN to any in via $CIF
#ipfw add deny log ip from not $LAN to any in via $DIF
# Stop private networks (RFC1918) from entering the outside interface.
ipfw add deny log ip from 192.168.0.0/16 to any in via $CIF
ipfw add deny log ip from 192.168.0.0/16 to any in via $DIF
ipfw add deny log ip from 172.16.0.0/12 to any in via $CIF
ipfw add deny log ip from 172.16.0.0/12 to any in via $DIF
ipfw add deny log ip from 10.0.0.0/8 to any in via $CIF
ipfw add deny log ip from 10.0.0.0/8 to any in via $DIF
ipfw add deny log ip from any to 192.168.0.0/16 in via $CIF
ipfw add deny log ip from any to 192.168.0.0/16 in via $DIF
ipfw add deny log ip from any to 172.16.0.0/12 in via $CIF
ipfw add deny log ip from any to 172.16.0.0/12 in via $DIF
ipfw add deny log ip from any to 10.0.0.0/8 in via $CIF
ipfw add deny log ip from any to 10.0.0.0/8 in via $DIF
ipfw add deny ip from 212.9.233.50 to any in via $CIF
ipfw add deny ip from 212.9.233.50 to any in via $DIF
# Stop draft-manning-dsua-01.txt nets on the outside interface
ipfw add deny log all from 0.0.0.0/8 to any in via $CIF
ipfw add deny log all from 0.0.0.0/8 to any in via $DIF
ipfw add deny log all from 169.254.0.0/16 to any in via $CIF
ipfw add deny log all from 169.254.0.0/16 to any in via $DIF
ipfw add deny log all from 192.0.2.0/24 to any in via $CIF
ipfw add deny log all from 192.0.2.0/24 to any in via $DIF
ipfw add deny log all from 224.0.0.0/4 to any in via $CIF
ipfw add deny log all from 224.0.0.0/4 to any in via $DIF
ipfw add deny log all from 240.0.0.0/4 to any in via $CIF
ipfw add deny log all from 240.0.0.0/4 to any in via $DIF
ipfw add deny log all from any to 0.0.0.0/8 in via $CIF
ipfw add deny log all from any to 0.0.0.0/8 in via $DIF
ipfw add deny log all from any to 169.254.0.0/16 in via $CIF
ipfw add deny log all from any to 169.254.0.0/16 in via $DIF
ipfw add deny log all from any to 192.0.2.0/24 in via $CIF
ipfw add deny log all from any to 192.0.2.0/24 in via $DIF
ipfw add deny log all from any to 224.0.0.0/4 in via $CIF
ipfw add deny log all from any to 224.0.0.0/4 in via $DIF
ipfw add deny log all from any to 240.0.0.0/4 in via $CIF
ipfw add deny log all from any to 240.0.0.0/4 in via $DIF
# Allow all established connections to persist (setup required
# for new connections).
ipfw add allow tcp from any to any established
#Deny Everything else
ipfw add 65534 deny log ip from any to any via $CIF in
ipfw add 65534 deny log ip from any to any via $DIF in
[-- Attachment #2 --]
= ipfw.core |'! whLB"r\&ABH2˙%j" b-*]ՆVwzTjū ţ[wn=`;CQdg3$$$$3$.5 = :NU;_VɱZk|3wR`1xC yG->n9v%`pNmQVS4>Yf j}mgMW:iz
: _Krΰ{ML0{}}{ Gbv숝B;ކ5 =vZc! 0 ?)D:״wHل"Ʈp0{ j#윮v4{iW0ߜNo>ߤw̜&{m0̶\?Ҏϥ8v$cuߜpն}u[^UԸHͤ7 CR{oju#3ܦt-,).eeu&{1&offnWʪ5
S rnnƮW0TיǢJ_[\AEM-ܔTTx[ϪSPTTVWVUYPnkt/-+r+Ӥ5nFI-]"p%Me`ٻ^c/;B;YWZCm֮4=\`/ IFHnvlyŮ EL]߹#h4.k6tzsČiڴ?;2ũW_wŦ7:rcc3㚁˳o]
)Φ5j
)NoU4ig^l.6-6wv]t/Y]p^ZBKmYިp3ѸI a9E%sK>;ں._ai^[7Vlimk4 Z{Zvig̜uN?5D3=3=r!lsiNXwg{qws
]U0vɰSTzSz~XnKq;bus6uWZP[Vuuv,ki_v4,F2]1 {Nt
/8XA{c6misϻ~yF {54^~_V^UHF8Y kF=r?qF5j<K|;cǰ'7c,!wG\\hF$3&8zh3 oƚqY?0o Do㵱KqFHll!~$6.3v2މGv^ǹT$IjOϩk|NF3AT^sZ4nlRgK*1qrK{cCKg5٘:#s `Μ+qlvHf 'ž`sH^4D_r3sYfegft<u;[N:7;
q|T.OU{v\s:N4^70kl~t'o^ 5]moÌ{_VډG cv$ Id$ }}&A%Q*ITJQJUFz9NVcj2듎mڿƨXeNM:
w %¾؇}O=߾zc{}o=ݾr'uNR'S7SiO՟է\&*Rg+G 5Ekߘ*[娩;4ھT5:Of+13NP
j okAL-7CjZi*Q]uK0:UZ߂V].VPՒ??>.S_PT\}I]TW/^^]QԵjN]nP7M&YݬnQ_W[ԭ/mj]}SݡTRwV{67oշ WW P~~ T ) # ?G? zJP?WO_gNzN=^P/_;kWnzCRV~VMVQCxW]z_}>T~}#\hx#M*RSJUg3S*UV(yVթB@իj9<Gz ʮEVo?&HvaE}
lȖycsE} '4F+ O>iGwDzkU ;Vox yYgrt5cfW.]Uh \{ M
KvVp:zvinYԞz U5"t/_4/媓 \<eԻ9YwSo9n ۷5e$?:X ]8ONvT*RFE@}>!t ,m/ c[?mc
سil%uK-Qe n_lٱk:;PONqޞpwX+k ʨǧ9VդʨsQ T \\qɡ>g̷t
vU &0gIԯ3rނcs aC]MݩnS[fIݠzU,tj|j潣VKAPUZľ><Ŀ@z4_OEߌg*~ֲODށXYx\ƎVqq6Dsc.uY\ן7՟;mhl uv|{G#cpqq$xifcL sܬYYP״4K[mk?/ eNב:
gegePC]i^f!So "!63^v2LQnlIRSucrp uo_ߡ揊 # c*g.3C թIJrIC G?<][1_e9#q H=]4F p( v$;:Չ_ϷׇIPGXw;}}M$; #̳7x8]oɁ +qD _(/}.ى m_ y?Ǘ ,)~;u>4#=Z~̮^z>7%9oS.}o>ii~8╎{) _ 7?:/iMK<ǘg>&;t>%'zĨ%ZIsf7Lc3x MŤc7 |l״/_$9gkކSx?z]o]]nPգiHQ_W~}Ͼ$l'3&~` oR|췳PDz&ܾ,ϊ,
eEVU]\[Z\^e'GMuMYe]qM~CG$BE~c{[$g)(
wꂺH8%kE̜̜L3V.YQPMjg6Z˫Vh[+slk{8hJWke/**_X\kWΫ-[T?x{ǟݯwi j}vvKǏN7 b4vnbZ_7iܵEW ϒQ?P%O͟_@;bߋFӱQF" 0
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?00d701c29c22$e04bcb80$0100a8c0>