From owner-freebsd-ipfw@FreeBSD.ORG Sun Sep 14 11:44:25 2014 Return-Path: Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id D918EA11; Sun, 14 Sep 2014 11:44:25 +0000 (UTC) Received: from sola.nimnet.asn.au (paqi.nimnet.asn.au [115.70.110.159]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 2F17BCA2; Sun, 14 Sep 2014 11:44:24 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by sola.nimnet.asn.au (8.14.2/8.14.2) with ESMTP id s8EBi5LW078052; Sun, 14 Sep 2014 21:44:05 +1000 (EST) (envelope-from smithi@nimnet.asn.au) Date: Sun, 14 Sep 2014 21:44:05 +1000 (EST) From: Ian Smith To: Willem Jan Withagen Subject: Re: IPFW rule sets and automatic rule numbering In-Reply-To: <54156FBB.1030907@digiware.nl> Message-ID: <20140914204055.K61666@sola.nimnet.asn.au> References: <541469D4.6070107@gmail.com> <54156FBB.1030907@digiware.nl> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Cc: "Alexander V. Chernikov" , Freddie Cash , bycn82 , freebsd-ipfw@freebsd.org X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Sep 2014 11:44:25 -0000 On Sun, 14 Sep 2014 12:36:43 +0200, Willem Jan Withagen wrote: > On 13-9-2014 21:51, Freddie Cash wrote: > > You can replicate it using 3 rules, loaded into two sets: > > > > ipfw set disable 1 > > ipfw add allow ip from any to any > > ipfw add 65524 allow ip from any to any > > ipfw add allow ip from any to any > > ipfw set swap 1 0 > > > > Run that two or 3 times. Every rule will be numbered 65534 after the 2nd or > > 3rd run. > > > > > I expected it to be numbered 10, 65524, 65534 after every run. > > > > However, after reading the man page a few more times and thinking about it > > a little more, it makes sense that the numbering is global across all sets, > > as you can have multiple sets enabled simultaneously. > > > > It just doesn't mesh with my desire to use auto numbering. I'm in the midst > > of manually numbering all my rules now. :) > This is easily circumvented by making shure that the first rule is > > ipfw add 10 ..... > like: > ipfw add count ip4 from any to any via vlan126 > (vlan126 is my outside connection) > And then you are home free. > > I actually use this to also separate diffent types of block by injecting: > ipfw add count ip from any to any > > like: > 03000 713812041 425643462848 count ip from any to any > 03010 0 0 deny ip6 from fc00::/7 to any via vlan126 > > And the 3000 block contains all antispoofing and likes. I'd almost replied along the same lines - also tending to number first rules in a block and then add unnumbered rules until other sections - before realising that once Freddie had added his rule 65524, maybe in another set, it's game over; every unnumbered rule added after that is going to be >= 65524 and <= 65534. And even as you have it above, if you rerun your script again without flushing the entire ruleset, apart from specifically numbered rule/s, everything will get readded after the highest rule previously used. Alexander said: > I think we can consider implementing sysctl which permits per-set > auto-numbering. Perhaps rather than a separate high water mark per set that would be reset on set N flush - which I think is what Alexander means? - if one could set something like maybe 'net.inet.ip.fw.autoinc_last' which would default, as now, to the highest rule added so far, but could be reset to something else before adding more auto_inc rules? Might get tricky, and of course it has to not break older rule scripts - some VERY old :) cheers, Ian