Date: Fri, 10 Sep 2010 19:55:34 +0700 From: Victor Sudakov <sudakov@sibptus.tomsk.ru> To: freebsd-questions@freebsd.org Subject: Re: ipfw fwd and ipfw allow Message-ID: <20100910125534.GA50527@admin.sibptus.tomsk.ru> In-Reply-To: <4C8754CD.6030003@gmx.com> References: <20100822052550.GA42346@admin.sibptus.tomsk.ru> <20100907090012.GA48608@admin.sibptus.tomsk.ru> <4C8616F0.5010401@gmx.com> <20100907110033.GA51618@admin.sibptus.tomsk.ru> <4C864145.80805@gmx.com> <20100907145223.GA55660@admin.sibptus.tomsk.ru> <4C8754CD.6030003@gmx.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Nikos Vassiliadis wrote: > >A packet generated locally 1) should be forwarded by a 'fwd' > >rule and 2) should create a dynamic 'allow' rule for returning > >traffic. Could you please suggest a ruleset for this. > > The fw has the 10.0.0.1 IP address. > The 10.0.0.100 IP address belongs to another computer running a TCP > service at 9999. > > The IPFW rules: > >fw# ipfw list > >00100 fwd 10.0.0.100 tcp from any to 10.90.10.3 dst-port 9999 keep-state > >00200 deny ip from any to any > >65535 allow ip from any to any It seems that the 'fwd ... keep-state' statement does create a useful dynamic rule. It contradicts the ipfw(8) man page but works. Thank you for enlightment. -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN sip:sudakov@sibptus.tomsk.ru
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20100910125534.GA50527>