From owner-freebsd-net@FreeBSD.ORG Wed Dec 15 09:44:12 2004 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4853316A4CE for ; Wed, 15 Dec 2004 09:44:12 +0000 (GMT) Received: from mx01.bos.ma.towardex.com (mx01.bos.ma.towardex.com [65.124.16.9]) by mx1.FreeBSD.org (Postfix) with ESMTP id 17A1343D1D for ; Wed, 15 Dec 2004 09:44:12 +0000 (GMT) (envelope-from haesu@mx01.bos.ma.towardex.com) Received: by mx01.bos.ma.towardex.com (TowardEX ESMTP 3.0p11_DAKN, from userid 1001) id F1E9B2F944; Wed, 15 Dec 2004 04:44:11 -0500 (EST) Date: Wed, 15 Dec 2004 04:44:11 -0500 From: James To: freebsd-net@freebsd.org Message-ID: <20041215094411.GA68129@scylla.towardex.com> References: <20041213124051.GB32719@cell.sick.ru> <20041214015603.A75019@xorpc.icir.org> <20041214060341.A77720@xorpc.icir.org> <41BEF746.E8362858@freebsd.org> <20041214063118.B77933@xorpc.icir.org> <41BF07A3.8F1F505E@freebsd.org> <20041214181231.GA80817@scylla.towardex.com> <20041215084540.GB53509@cell.sick.ru> <20041215084909.GA44268@scylla.towardex.com> <20041215091329.GD53509@cell.sick.ru> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20041215091329.GD53509@cell.sick.ru> User-Agent: Mutt/1.4.1i Subject: Re: per-interface packet filters [summary] X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Dec 2004 09:44:12 -0000 On Wed, Dec 15, 2004 at 12:13:29PM +0300, Gleb Smirnoff wrote: > On Wed, Dec 15, 2004 at 03:49:09AM -0500, James wrote: > J> On Wed, Dec 15, 2004 at 11:45:40AM +0300, Gleb Smirnoff wrote: > J> > On Tue, Dec 14, 2004 at 01:12:31PM -0500, James wrote: > J> > J> The way we have approached this in the past is to install /32 host routes > J> > J> for each interface addr's and respective subnet and broadcast /32 addresses > J> > J> into the kernel RIB, destined to lo0 interface. Place your per-interface > J> > J> filter on 'lo0' interface and packets destined to router iteslf will be > J> > J> subject to loopback filter before making it onto upper layer protocol. > J> > > J> > I was thinking of this idea, too. So, it works? > J> > J> It works indeed. If folks want me to, I'll provide patches to ip_fastfwd.c > J> after christmas-new-year break. (I have too much stuff on my plate right now) > > Please do it. Roger. Will post when done. -J -- James Jun TowardEX Technologies, Inc. Technical Lead Boston IPv4/IPv6 Web Hosting, Colocation and james@towardex.com Network design/consulting & configuration services cell: 1(978)-394-2867 web: http://www.towardex.com , noc: www.twdx.net