Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 8 Jan 2005 22:36:09 +0100
From:      Christian Hiris <4711@chello.at>
To:        freebsd-ipfw@freebsd.org
Cc:        "heath, Chia Hui Chen" <heath0504@gmail.com>
Subject:   Re: ipfw + MAC nothing happens?
Message-ID:  <200501082236.24796.4711@chello.at>
In-Reply-To: <010b01c4f5a1$aaa730c0$f8813b3d@linuxlmx20ji5l>
References:  <007101c4f584$d9a7fd90$f8813b3d@linuxlmx20ji5l> <200501081721.37351.4711@chello.at> <010b01c4f5a1$aaa730c0$f8813b3d@linuxlmx20ji5l>

next in thread | previous in thread | raw e-mail | index | archive | help
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Saturday 08 January 2005 17:46, heath, Chia Hui Chen wrote:
> It's strange.
> I use two computer to test.
> One called A (00:e0:18:62:xx:xx)
> another called B.
>
> And the rulesets is same as you said.
> I try reboot and use A to connect port 443 of one site.
> IPFW output are below:
> ============================================================

The diverted packets are not layer-2 packets, so they must be able to bypass 
the layer-2 rules. In our case all diverted packets match rule 30, because 
none of the two layer-2 rules (10 and 20) applies.
So please add the rule below to your ruleset. If this doesn't work, I will try 
to reproduce this on one of my boxes. 

  ipfw add 9 skipto 50 all from any to any not layer2

> 00010    4     190 skipto 30 ip from any to any MAC any 00:e0:18:62:xx:xx
> 00020 2273 1136464 skipto 50 ip from any to any MAC any any
> 00030    3     144 deny tcp from any to any dst-port 443
> 00050 3476 1000174 divert 8668 ip from any to any via fxp0
> 00100  420  109610 allow ip from any to any via lo0
> 00200    0       0 deny ip from any to 127.0.0.0/8
> 00300    0       0 deny ip from 127.0.0.0/8 to any
> 65000 8022 3082293 allow ip from any to any
> 65535    1      89 deny ip from any to any
> ============================================================
>
> And then I test it by using computer B.
> Output is as below:
>
> ============================================================
> 00010     4     190 skipto 30 ip from any to any MAC any 00:e0:18:62:xx:xx
> 00020  4246 1931785 skipto 50 ip from any to any MAC any any
> 00030     6     288 deny tcp from any to any dst-port 443
> 00050  4699 1427090 divert 8668 ip from any to any via fxp0
> 00100   658  147594 allow ip from any to any via lo0
> 00200     0       0 deny ip from any to 127.0.0.0/8
> 00300     0       0 deny ip from 127.0.0.0/8 to any
> 65000 11953 4671673 allow ip from any to any
> 65535     1      89 deny ip from any to any
> ============================================================
> It seems that rule 20 is active, but rule 30 is active, too.
> What would I do next?
> I'm sorry to bother you, but could you help me again?
> Thanx!
>
> ----- Original Message -----
> From: "Christian Hiris" <4711@chello.at>
> To: "heath, Chia Hui Chen" <heath0504@gmail.com>
> Sent: Sunday, January 09, 2005 12:21 AM
> Subject: Re: ipfw + MAC nothing happens?
>
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > On Saturday 08 January 2005 16:57, heath, Chia Hui Chen wrote:
> > > Thanks.
> > > I try it, but something wrong.
> >
> > I would try to put the respective rules on top:
> >
> >  ipfw add 10 skipto 30 ip from any to any MAC any 00:e0:18:62:xx:xx
> >  ipfw add 20 skipto 50 ip from any to any MAC any any
> >  ipfw add 30 deny tcp from any to any dst-port 443
> >
> >  00050 divert 8668 ip from any to any via fxp0
> >  00100  ip from any to any via lo0
> >  00200  deny ip from any to 127.0.0.0/8
> >  00300  deny ip from 127.0.0.0/8 to any
> >  65000  allow ip from any to any
> >  65535  deny ip from any to any
> >
> > If this also doesn't work, please post your ipfw output again.
> >
> > > 00050 22484 11388448 divert 8668 ip from any to any via fxp0
> > > 00100  4414  2006448 allow ip from any to any via lo0
> > > 00200     0        0 deny ip from any to 127.0.0.0/8
> > > 00300     0        0 deny ip from 127.0.0.0/8 to any
> > > 00400    52     4053 skipto 1000 ip from any to any MAC any
> > > 00:e0:18:62:xx:xx
> > > 00600  7008  3465293 skipto 65000 ip from any to any MAC any any
> > > 01000    33     1584 deny tcp from any to any dst-port 443
> > > 65000 46408 25226370 allow ip from any to any
> > > 65535     0        0 deny ip from any to any
> > >
> > > It looks like all my computer at the NAT are deny to access port 443.
> > > Can you plz tell me what's wrong?
> > > Thank you again.
> >
> > - --
> > Christian Hiris <4711@chello.at> | OpenPGP KeyID 0x3BCA53BE
> > OpenPGP-Key at hkp://wwwkeys.eu.pgp.net and http://pgp.mit.edu
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.2.6 (FreeBSD)
> >
> > iD8DBQFB4AiR09WjGjvKU74RAiShAJ9EnhROvbpSm61CXXxsNgLeCspPDgCdET99
> > xDxxjHfo2Y9n17w3S7p+9xY=
> > =eqfj
> > -----END PGP SIGNATURE-----
>
> _______________________________________________
> freebsd-ipfw@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
> To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org"

- -- 
Christian Hiris <4711@chello.at> | OpenPGP KeyID 0x3BCA53BE 
OpenPGP-Key at hkp://wwwkeys.eu.pgp.net and http://pgp.mit.edu
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (FreeBSD)

iD8DBQFB4FJY09WjGjvKU74RAkkJAJ9Sb64T/iqGBhcRHVIc/CSgXLEkSACfQcxE
5LyuPZoRoHmL8cYXvO4hf8M=
=Kp2k
-----END PGP SIGNATURE-----



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200501082236.24796.4711>