From owner-freebsd-ipfw@FreeBSD.ORG Tue Nov 8 16:24:40 2011 Return-Path: Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 2F6B61065670 for ; Tue, 8 Nov 2011 16:24:40 +0000 (UTC) (envelope-from korodev@gmail.com) Received: from mail-wy0-f182.google.com (mail-wy0-f182.google.com [74.125.82.182]) by mx1.freebsd.org (Postfix) with ESMTP id B95F58FC0C for ; Tue, 8 Nov 2011 16:24:39 +0000 (UTC) Received: by wyg36 with SMTP id 36so920566wyg.13 for ; Tue, 08 Nov 2011 08:24:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:from:date:message-id:subject:to:content-type; bh=irFU9dj/EXQd8fMLD1otit0KYlVjnyYp/H5SPlN7Ecs=; b=Yp9cU9q1+NHFvdz71GFW5Q1CSSzqWk2CuiTYcc6QIleQfBFdCRAjKztyajTWwn1qEA o8XTVO2EH6pXQl54ugCWG2pTUl2n4Ba7JbTnBuI/hC3ulIyMDltL6p4BD+4lMQEofucZ 1K+1IefUTqb5vAx14cSyntf6g8DDz7CTvWmAY= Received: by 10.180.90.19 with SMTP id bs19mr13544252wib.7.1320767701051; Tue, 08 Nov 2011 07:55:01 -0800 (PST) MIME-Version: 1.0 Received: by 10.180.87.68 with HTTP; Tue, 8 Nov 2011 07:54:40 -0800 (PST) From: Korodev Date: Tue, 8 Nov 2011 09:54:40 -0600 Message-ID: To: freebsd-ipfw@freebsd.org Content-Type: text/plain; charset=UTF-8 Subject: Protecting bridge interface via external interface and IPFW X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Nov 2011 16:24:40 -0000 I'm currently running a typical bridge setup on 8.2 with if_bridge and ipfw (tunings below) and I've set up a libpcap tool to monitor packets traversing bridge interface. I've got some traffic that I don't want the tool to see, so I've firewalled it off using ipfw. However, it appears that no matter how I tune my sysctl knobs, the bridge interface will always see the packet regardless if it's blocked or not by the ipfw at the external physical interface. I have played with pfil_member, and seen no changes in this activity. Are there any modifications, whether it be patches, sysctl tunings, or virtual interface trickery to allow IPFW to act as a "shield" to my libpcap program? Here are my sysctl tunings: net.link.bridge.ipfw: 1 net.link.bridge.pfil_local_phys: 0 net.link.bridge.pfil_member: 0 net.link.bridge.pfil_bridge: 0 Edit: It looks like I have the exact same question as this individual that was never answered on the forums: http://forums.freebsd.org/showthread.php?t=24372 \\korodev