Date: Sun, 17 Feb 2002 22:41:50 -0800 From: "Crist J. Clark" <cjc@FreeBSD.ORG> To: Will Froning <wfroning@angui.sh> Cc: questions@FreeBSD.ORG Subject: Re: natd and dynamic rules Message-ID: <20020217224150.U48401@blossom.cjclark.org> In-Reply-To: <20020217201322.E46783-100000@angui.sh>; from wfroning@angui.sh on Sun, Feb 17, 2002 at 08:13:51PM -0800 References: <20020217201322.E46783-100000@angui.sh>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Feb 17, 2002 at 08:13:51PM -0800, Will Froning wrote:
> [please CC me on replies, thanks]
>
> I have an issue with natd and my dynamic ipfw rules. Here goes.
>
> I recently implemented natd on my FBSD4.5 firewall. Here are the
> relevant ipfw rules (internal ip=192.168.100.1):
>
> 01400 divert 8668 ip from any to any via dc0
> 01500 check-state
> 01600 deny log tcp from any to any established
> 01700 allow tcp from ${oip} to any keep-state out setup
> 02800 allow ip from 192.168.100.0/24 to any keep-state via dc1
>
> When I start a ssh session from my firewall to my mail server the
> dynamic rule gets the correct lifetime value from
> net.inet.ip.fw.dyn_ack_lifetime.
>
> When I start a ssh session from 192.168.100.2 to my firewall's
> internal interface, I again get the correct lifetime value from
> net.inet.ip.fw.dyn_ack_lifetime.
>
> When I start a ssh session from 192.168.100.2 to a remote machine, the
> packet gets through just fine. But when the dynamic rules come up I
> was suspecting both 2800 and 1700 to have the same lifetime value.
> That's not the case. It seems when natd sends the packet out, the
> outgoing packet gets it's lifetime value from
> net.inet.ip.fw.dyn_syn_lifetime NOT net.inet.ip.fw.dyn_ack_lifetime!
>
> So my questions are these:
>
> 1) Is this purposely done by implementation or is this a bug in either
> ipfw or natd?
>
> 2) If this is a "feature", is there any way to change this to have
> both rules look at the same lifetime value?
It always seems like questions come in groups.
http://docs.freebsd.org/cgi/getmsg.cgi?fetch=13412+0+archive/2002/freebsd-net/20020217.freebsd-net
http://docs.freebsd.org/cgi/getmsg.cgi?fetch=2858187+0+archive/2002/freebsd-questions/20020217.freebsd-questions
--
Crist J. Clark | cjclark@alum.mit.edu
| cjclark@jhu.edu
http://people.freebsd.org/~cjc/ | cjc@freebsd.org
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020217224150.U48401>