From owner-freebsd-net@FreeBSD.ORG Wed Mar 5 13:26:53 2014 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id D2059956 for ; Wed, 5 Mar 2014 13:26:53 +0000 (UTC) Received: from mail-oa0-x22d.google.com (mail-oa0-x22d.google.com [IPv6:2607:f8b0:4003:c02::22d]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 9A91C93D for ; Wed, 5 Mar 2014 13:26:53 +0000 (UTC) Received: by mail-oa0-f45.google.com with SMTP id o6so995490oag.4 for ; Wed, 05 Mar 2014 05:26:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=bvxGWr8cyVu6z95VVlSfDaUBMq9d0cu66R20cdfSbNI=; b=qYA3v4X57Uk9+X1yNVaXbDMXL0xI1W4HOYklIvxF+8lFVSFajllfCq19FpB5fSUpXX mzqOqGjgtmnOQlQZMe5aYSnho0Xl44JxdM6HriGSG6xJhu8RyvztPXW3JLuJqrYCrl56 gMiWVaYrIY1J4Jv4o2Gw/ncx4K9wvnnUXi85dcUESfVxW67IzC0OkXCnGv0mJoE3+8WX 7YjVmGIQWl3PXeXiU/45itIusfsnb5xlyVu+Mh4FfhcqYfeT+zcaIZdidbQ0L/3ideBD d1CFTfKOrrJub3Hq8PutP4gatlBybckdODMpIp73flWkQom2Imx2NCdIub828ZpMPLZA L38g== X-Received: by 10.60.173.233 with SMTP id bn9mr398141oec.9.1394026012878; Wed, 05 Mar 2014 05:26:52 -0800 (PST) MIME-Version: 1.0 Received: by 10.60.232.72 with HTTP; Wed, 5 Mar 2014 05:26:32 -0800 (PST) In-Reply-To: References: From: Raimundo Santos Date: Wed, 5 Mar 2014 10:26:32 -0300 Message-ID: Subject: Re: ipfw / routing issue on 9.2-RELEASE To: Andreas Nilsson Content-Type: text/plain; charset=ISO-8859-1 X-Content-Filtered-By: Mailman/MimeDel 2.1.17 Cc: FreeBSD Net X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Mar 2014 13:26:53 -0000 Hello, Andreas. If table(12) is empty, how will fwd know where to send the packets that hits it? Best regards, Raimundo On 4 March 2014 02:58, Andreas Nilsson wrote: > Hello, > > I'm having a strange problem with ipfw and/or routing. I've only tested > this on 9.2-RELEASE-p3, amd64. The machine is sort of acting as router. The > ruleset is like (ipfw defaults to accept): > > $cmd="ipfw -fq " > > $cmd add 1 skipto 65534 log all from "table(1)" to any in recv "table(8)" > > ... > > $cmd add 65534 fwd tablearg all from "table(12)" to any > > Table 1 contains prefixes that should skip the normal rules and just pass > through the box. > > Table 8 contains interface names. > > Table 12 is empty (so far). > > What happens is that packets that trigger the first rule never get to their > destination. After looking at /var/log/security is see that packets trigger > the rule, "never to be seen again". There is a route (ie not default) for > the destination, but a tcpdump on the corresponding interface shows > nothing. > > > On changing the ruleset to > $cmd="ipfw -fq " > > $cmd add 1 skipto 65533 log all from "table(1)" to any in recv "table(8)" > > ... > > $cmd add 65533 fwd x.y.z.w ip from "table(1)" to any in recv "table(8)" > > $cmd add 65534 fwd tablearg all from "table(12)" to any > > packets get to where they should. > > > Why do I need the explict fwd rule? As far as I can see the ipfw man page > says nothing about skipto changing the packets, and since the 65533 rule in > the second ruleset triggers on the same thing as the skipto rule it would > seem like packets are "intact". Why does the kernel not forward those > packets? > > > Best regards > > Andreas Nilsson > _______________________________________________ > freebsd-net@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org" >