Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 3 Sep 2018 17:12:17 +0700
From:      Eugene Grosbein <eugen@grosbein.net>
To:        Runer <run00er@gmail.com>, freebsd-net@freebsd.org
Subject:   Re: Ipfw fwd with route(8) RTF_BLACKHOLE and fast forwarding on FreeBSD 11
Message-ID:  <10c4591a-3d82-bddb-093d-a73da1d9b2b8@grosbein.net>
In-Reply-To: <99f99bf0-59ef-11e7-d1a4-c34a40492308@gmail.com>
References:  <99f99bf0-59ef-11e7-d1a4-c34a40492308@gmail.com>

next in thread | previous in thread | raw e-mail | index | archive | help
03.09.2018 14:02, Runer wrote:
> *Hello Community!
> 
> A situation has arisen in which ipfw fwd stops working when
> RTF_BLACKHOLE or RTF_REJECT, ROUTE (8), is enabled on Freebsd 11 release.
> **
> 
> FreeBSD 11.2-RELEASE-p1 route add default 127.0.0.1 -blackhole –iface ipfw show00100 30 4056 fwd 10.0.0.5 ip from table(1) to not 10.0.0.0/8 in via em0 The packet counter changes, but forwarding does not work.On FreeBSD 10 everything works fine. I suppose this is due to changes to forwarding -> fast forwarding by default in FreeBSD 11 and man ROUTE (8), “BUGS - unless IP fast forwarding is enabled, in which case the meaning of the flag will always be honored.”
> I want to know if it's possible to implement the work ipfw fwd together with RTF_BLACKHOLE on FreeBSD 11 as before in FreeBSD 10? Thank you in advance!
> 
> ***

As temporary workaround, you still can disable fast forwarding path:

- make sure you use GENERIC kernel or your custom kernel has "options IPSEC_SUPPORT" like GENERIC has;
- load ipsec kernel module by means of /boot/loader.conf or /etc/rc.conf;
- add dummy security policy:

printf "flush;\nspdflush;\n\nspdadd 100.64.0.1/32 100.64.0.2/32 esp -P out none;\n" > /etc/ipsec.conf

It does nothing but prevents a kernel from using fast forwarding path for 11.2




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?10c4591a-3d82-bddb-093d-a73da1d9b2b8>