Date: Tue, 30 Sep 2014 15:29:11 +1000 (EST) From: Ian Smith <smithi@nimnet.asn.au> To: Jack Barber <jack@nyi.net> Cc: freebsd-ipfw@freebsd.org Subject: Re: trouble with ipfw on FreeBSD 10 Message-ID: <20140930150819.Y48482@sola.nimnet.asn.au> In-Reply-To: <5429F7A6.3060701@nyi.net> References: <5429F7A6.3060701@nyi.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, 29 Sep 2014 20:21:58 -0400, Jack Barber wrote:
> We are having trouble getting ipfw to work over a bridged interface.
>
> for example:
>
> machine 1 -> Bridged interface FreeBSD 10 -> machine 2.
>
> machine 1 - 192.168.20.20
> machine 2 - 192.168.20.25
>
> now I set something like this in /etc/ipfw.rules:
>
> $IPFWcmd add deny all from 192.168.20.20/24 to any
> $IPFWcmd add deny all from any to 192.168.20.20/24
>
> where both machine 1 and machine 2 are on said subnet and already work.
Please confirm that these two are only connected via two interfaces on
the bridge/ipfw box, with no switch involved? And that these rules,
once working, should deny traffic between ANY hosts in this /24 subnet?
> when I reload the rules, I am unable to stop a connection between
> machine 1 and machine 2.
>
> I've already made sure that ipfw is running(loaded), and the rules
> appear to take, and even show up with "ipfw show".
>
> # ipfw show
> ...
> 01700 0 0 deny ip from 192.168.20.0/24 to any
> 01800 0 0 deny ip from any to 192.168.20.0/24
> 65535 9227 11389032 allow ip from any to any
>
> However, there is no effect on data travelling over the pipe at all.
>
> This setup was confirmed many times to work with FreeBSD 9.2, but it
> does not work on 10. any help is appreciated.
What values are set for these sysctls?
net.link.ether.ipfw: 0
Controls whether layer-2 packets are passed to ipfw. Default is
no.
net.link.bridge.ipfw: 0
Controls whether bridged packets are passed to ipfw. Default is
no.
cheers, Ian
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20140930150819.Y48482>