Date: Fri, 04 Apr 2008 01:52:17 +0200 From: Ivan Voras <ivoras@freebsd.org> To: freebsd-net@freebsd.org Subject: Re: Trouble with IPFW or TCP? Message-ID: <ft3qji$cr9$1@ger.gmane.org> In-Reply-To: <20080403234059.GA53417@owl.midgard.homeip.net> References: <ft3phn$ai3$1@ger.gmane.org> <20080403234059.GA53417@owl.midgard.homeip.net>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
Erik Trulsson wrote:
> On Fri, Apr 04, 2008 at 01:34:07AM +0200, Ivan Voras wrote:
>> In which case would an ipfw ruleset like this:
>>
>> 00100 114872026 40487887607 allow ip from any to any via lo0
>> 00200 0 0 deny ip from any to 127.0.0.0/8
>> 00300 0 0 deny ip from 127.0.0.0/8 to any
>> 00600 1585 112576 deny ip from table(0) to me
>> 01000 90279 7325972 allow icmp from any to any
>> 05000 475961039 334422494257 allow tcp from me to any setup keep-state
>> 05100 634155 65779377 allow udp from me to any keep-state
>> 06022 409604 69177326 allow tcp from any to me dst-port 22 setup
>> keep-state
>> 06080 52159025 43182548092 allow tcp from any to me dst-port 80 setup
>> keep-state
>> 06443 6392366 2043532158 allow tcp from any to me dst-port 443 setup
>> keep-state
>> 07020 517065 292377553 allow tcp from any to me dst-port 8080 setup
>> keep-state
>> 65400 12273387 629703212 deny log ip from any to any
>> 65535 0 0 deny ip from any to any
>
> If you are using 'keep-state' should there not also be some rule containing
> 'check-state' ?
Not according to the ipfw(8) manual:
"""
These dynamic rules, which have a limited lifetime, are checked at the
first occurrence of a check-state, keep-state or limit rule, and
are typ-
ically used to open the firewall on-demand to legitimate traffic only.
See the STATEFUL FIREWALL and EXAMPLES Sections below for more
informa-
tion on the stateful behaviour of ipfw.
"""
I read this to mean the dynamic rules are checked at rule #5000 from the
above list. Is there an advantage to having an explicit check-state rule
in simple rulesets like this one?
[-- Attachment #2 --]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFH9W2xldnAQVacBcgRAjBJAKDabcurfBDVJOTfpscs4EDJ81r5VgCfc8LD
jC+ufoPOHjpxuExmy7syXjE=
=X4TR
-----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?ft3qji$cr9$1>