Date: Fri, 18 Dec 2009 00:45:53 +0100 From: Max Laier <max@love2party.net> To: freebsd-ipfw@freebsd.org Cc: David Horn <dhorn2000@gmail.com>, Hajimu UMEMOTO <ume@freebsd.org> Subject: Re: Unified rc.firewall ipfw me/me6 issue Message-ID: <200912180045.53942.max@love2party.net> In-Reply-To: <25ff90d60912162320y286e37a0ufeb64397716d8c18@mail.gmail.com> References: <25ff90d60912162320y286e37a0ufeb64397716d8c18@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thursday 17 December 2009 08:20:47 David Horn wrote: > Hajimu -- > > Thanks for working on rc.firewall, as the old scenario of dualing > rc.firewall/rc.firewall6 was not easily used in the default configurations > when running dual stack. The new rc.firewall has some very decent sane > defaults. My testing so far as been concentrated on > firewall_type="client", dual stack v4/v6 with SLAAC for IPv6, and DHCP for > IPv4. I will try some of the IPv6 tunnel scenarios later. > > I ran some tests against the now committed to -current /etc/rc.firewall, > and think have found an issue. In every line that has the "me" token > without the equivalent "me6" token, the command is only taking affect for > ipv4. > > For example: > > ${fwcmd} add pass udp from me to any 53 keep-state > > will allow dns requests from the client to pass, but if the destination > host is ipv6, this rule does not work. Instead you need: > > ${fwcmd} add pass udp from { me or me6 } to any 53 keep-state > > The same issue exists for several other entries as well. (possible diff > attached) The other option is to modify ipfw to actually have three > different "me" tokens (me/me4/me6) where the new "me" token would match > both ipv4 and ipv6 local interface addresses. Currently "me" matches only > ipv4 addresses on my amd64 -current box. The problem with this approach is and has been that it would change the meaning of "me". IIRC, it was considered a POLA violation to do that back when the IPv6 functionality was merged. An alternative would be to introduce a new name for me when we don't care which address family - e.g. me_any, mine, me64, me12, ... pick your color. > Thoughts anyone? > > --Thanks! > > -_Dave Horn > > P.S., might also be nice to have an UPDATING entry for unified rc.firewall > > > !DSPAM:4b29e29a301561928620662! >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200912180045.53942.max>