From owner-freebsd-net@FreeBSD.ORG Wed Dec 15 09:13:32 2004 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2CAD416A4CE; Wed, 15 Dec 2004 09:13:32 +0000 (GMT) Received: from relay.bestcom.ru (relay.bestcom.ru [217.72.144.5]) by mx1.FreeBSD.org (Postfix) with ESMTP id 45E4B43D49; Wed, 15 Dec 2004 09:13:31 +0000 (GMT) (envelope-from glebius@freebsd.org) Received: from cell.sick.ru (root@cell.sick.ru [217.72.144.68]) by relay.bestcom.ru (8.13.1/8.12.9) with ESMTP id iBF9DUnR089647 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Wed, 15 Dec 2004 12:13:30 +0300 (MSK) (envelope-from glebius@freebsd.org) Received: from cell.sick.ru (glebius@localhost [127.0.0.1]) by cell.sick.ru (8.12.11/8.12.8) with ESMTP id iBF9DTeo054022 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 15 Dec 2004 12:13:29 +0300 (MSK) (envelope-from glebius@freebsd.org) Received: (from glebius@localhost) by cell.sick.ru (8.12.11/8.12.11/Submit) id iBF9DTXb054021; Wed, 15 Dec 2004 12:13:29 +0300 (MSK) (envelope-from glebius@freebsd.org) X-Authentication-Warning: cell.sick.ru: glebius set sender to glebius@freebsd.org using -f Date: Wed, 15 Dec 2004 12:13:29 +0300 From: Gleb Smirnoff To: James Message-ID: <20041215091329.GD53509@cell.sick.ru> Mail-Followup-To: Gleb Smirnoff , James , Andre Oppermann , Luigi Rizzo , freebsd-net@freebsd.org, Max Laier References: <20041213124051.GB32719@cell.sick.ru> <20041214015603.A75019@xorpc.icir.org> <20041214060341.A77720@xorpc.icir.org> <41BEF746.E8362858@freebsd.org> <20041214063118.B77933@xorpc.icir.org> <41BF07A3.8F1F505E@freebsd.org> <20041214181231.GA80817@scylla.towardex.com> <20041215084540.GB53509@cell.sick.ru> <20041215084909.GA44268@scylla.towardex.com> Mime-Version: 1.0 Content-Type: text/plain; charset=koi8-r Content-Disposition: inline In-Reply-To: <20041215084909.GA44268@scylla.towardex.com> User-Agent: Mutt/1.5.6i X-Virus-Scanned: clamd / ClamAV version devel-20041013, clamav-milter version 0.75l on 127.0.0.1 X-Virus-Status: Clean cc: Luigi Rizzo cc: Andre Oppermann cc: Max Laier cc: freebsd-net@freebsd.org Subject: Re: per-interface packet filters [summary] X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Dec 2004 09:13:32 -0000 On Wed, Dec 15, 2004 at 03:49:09AM -0500, James wrote: J> On Wed, Dec 15, 2004 at 11:45:40AM +0300, Gleb Smirnoff wrote: J> > On Tue, Dec 14, 2004 at 01:12:31PM -0500, James wrote: J> > J> The way we have approached this in the past is to install /32 host routes J> > J> for each interface addr's and respective subnet and broadcast /32 addresses J> > J> into the kernel RIB, destined to lo0 interface. Place your per-interface J> > J> filter on 'lo0' interface and packets destined to router iteslf will be J> > J> subject to loopback filter before making it onto upper layer protocol. J> > J> > I was thinking of this idea, too. So, it works? J> J> It works indeed. If folks want me to, I'll provide patches to ip_fastfwd.c J> after christmas-new-year break. (I have too much stuff on my plate right now) Please do it. J> Just to note, the patch will _not_ touch ip_input.c. Receive path should not J> even exist on a host system, only on a router running hard core routing code J> (aka ip_fastforward() being the routing code). I agree on this point (also read your another mail about ip_fastforward). -- Totus tuus, Glebius. GLEBIUS-RIPN GLEB-RIPE