From owner-freebsd-net@FreeBSD.ORG Sat Apr 30 10:44:51 2011 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 36E8A106566B for ; Sat, 30 Apr 2011 10:44:51 +0000 (UTC) (envelope-from lev@FreeBSD.org) Received: from onlyone.friendlyhosting.spb.ru (onlyone.friendlyhosting.spb.ru [IPv6:2a01:4f8:131:60a2::2]) by mx1.freebsd.org (Postfix) with ESMTP id CB1E88FC14 for ; Sat, 30 Apr 2011 10:44:50 +0000 (UTC) Received: from lion.home.serebryakov.spb.ru (unknown [IPv6:2001:470:923f:1:c9d:ce4b:69a5:29c1]) (Authenticated sender: lev@serebryakov.spb.ru) by onlyone.friendlyhosting.spb.ru (Postfix) with ESMTPA id 06D824AC2D for ; Sat, 30 Apr 2011 14:44:48 +0400 (MSD) Date: Sat, 30 Apr 2011 14:44:40 +0400 From: Lev Serebryakov Organization: FreeBSD X-Priority: 3 (Normal) Message-ID: <278293310.20110430144440@serebryakov.spb.ru> To: freebsd-net@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=windows-1251 Content-Transfer-Encoding: quoted-printable Subject: gif interface uses IPv4 address before it is assigned to "real" interface. Is it ok? X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: lev@FreeBSD.org List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 30 Apr 2011 10:44:51 -0000 Hello, Freebsd-net. It seems, gif, configured with "tunnel my-IPv4 other-IPv4" starts to send IPv4 packages BEFORE "my-IPv4" is assigned to any interface in system. I have system, which connected to IPv4-internet via PPPoE with mpd5. Also, it is connected to IPv6-internet with tunnel from Hurricane Electric. gif0 is configured before mpd5 starts, so, my real IPv4 address is not present in system when gif0 is configured. But gif0 sends packets BEFORE mpd5 start into physical interface, which connects me with ISP. It has 10/8 address, and NAT on it to allow to communicate with ISP's local network. NAT and firewall is stateful, so NAT "from my-IPv4 to 10/8" works and remember this state. After that, all incoming packets from tunnel are de-NATed to 10/8 address, which is complete madness :) Why gif0 uses address which is not configured on any underlying interface yet? Is here any way to reset state of only ONE stateful ipfw rule from command line, which could be work-around for me? --=20 // Black Lion AKA Lev Serebryakov