Date: Tue, 25 Sep 2001 21:24:32 +0300 From: Ruslan Ermilov <ru@FreeBSD.ORG> To: Poul-Henning Kamp <phk@critter.freebsd.dk> Cc: fj@batmule.dk, freebsd-bugs@FreeBSD.ORG Subject: Re: misc/30255: [PATCH] Packets reinjected by natd but denied by ipfw generates annoying errors Message-ID: <20010925212432.F57333@sunbay.com> In-Reply-To: <32094.1001439610@critter>; from phk@critter.freebsd.dk on Tue, Sep 25, 2001 at 07:40:10PM %2B0200 References: <20010925202933.A57333@sunbay.com> <32094.1001439610@critter>
next in thread | previous in thread | raw e-mail | index | archive | help
I'm still waiting for a real-world example of where it would be useful at the minimum, and unavoidable at the maximum. :-) On Tue, Sep 25, 2001 at 07:40:10PM +0200, Poul-Henning Kamp wrote: > In message <20010925202933.A57333@sunbay.com>, Ruslan Ermilov writes: > >On Tue, Sep 25, 2001 at 07:14:48PM +0200, Poul-Henning Kamp wrote: > >> > >> >State-Changed-From-To: open->closed > >> >State-Changed-By: ru > >> >State-Changed-When: Tue Sep 25 07:24:17 PDT 2001 > >> >State-Changed-Why: > >> > >> >With my MAINTAINER hat on, I don't like this option. > >> > > >> >This error usually indicates a misconfigured firewall. > >> >It is almost always possible to write firewall rules > >> >that do not result in EACCES from firewall. > >> > >> I think you're being too harsh here Ruslan. While it may theoretically > >> be possible to write such rules, I have myself often found it simpler > >> and faster to reject on the "backside" of natd. > >> > >Just give me one real example where it's really useful, and I'll probably > >agree. > > > >> Considering what is proposed is an option I think it should be committed. > >> > >OK, how about this instead? > > > >I can change the code so that it logs various warnings at > >different syslog(3) levels. Then what gets logged may be > >controlled via syslog.conf(5). > > I think that is always a good idea, but this particular switch > makes more sense as a direct option I think... > > > -- > Poul-Henning Kamp | UNIX since Zilog Zeus 3.20 > phk@FreeBSD.ORG | TCP/IP since RFC 956 > FreeBSD committer | BSD since 4.3-tahoe > Never attribute to malice what can adequately be explained by incompetence. -- Ruslan Ermilov Oracle Developer/DBA, ru@sunbay.com Sunbay Software AG, ru@FreeBSD.org FreeBSD committer, +380.652.512.251 Simferopol, Ukraine http://www.FreeBSD.org The Power To Serve http://www.oracle.com Enabling The Information Age To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010925212432.F57333>