Date: Sat, 6 Mar 2004 16:05:23 -0500 From: James <haesu@towardex.com> To: Andre Oppermann <andre@freebsd.org> Cc: James <haesu@towardex.com> Subject: Re: My planned work on networking stack Message-ID: <20040306210523.GA10214@scylla.towardex.com> In-Reply-To: <4048F1B7.934AAC89@freebsd.org> References: <4043B6BA.B847F081@freebsd.org> <200403011507.52238.wes@softweyr.com> <20040302031625.GA4061@scylla.towardex.com> <20040302042957.GH3841@saboteur.dek.spc.org> <20040302082625.GE22985@cell.sick.ru> <20040303181034.GA58284@scylla.towardex.com> <404653DB.186DA0C2@freebsd.org> <4048F1B7.934AAC89@freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
thank you! :) i'll try this sometime next week and let you know of any feedbacks i have. -J > > Here you go: > > http://www.nrg4u.com/freebsd/ipfw_versrcreach.diff > > This one implements the standard functionality, the definition of an > interface through which it has to be reachable is not (yet) supported. > > Using this option only makes sense when you don't have a default route > which naturally always matches. So this is useful for machines acting > as routers with a default-free view of the entire Internet as common > when running a BGP daemon (Zebra/Quagga or OpenBSD bgpd). > > One useful way of enabling it globally on a router looks like this: > > ipfw add xxxx deny ip from any to any not versrcreach > > or for an individual interface only: > > ipfw add xxxx deny ip from any to any not versrcreach recv fxp0 > > I'd like to get some feedback (and a man page draft) before I commit it > to -CURRENT. > > -- > Andre -- James Jun TowardEX Technologies, Inc. Technical Lead Network Design, Consulting, IT Outsourcing james@towardex.com Boston-based Colocation & Bandwidth Services cell: 1(978)-394-2867 web: http://www.towardex.com , noc: www.twdx.net
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040306210523.GA10214>