From owner-freebsd-net@FreeBSD.ORG  Wed Jul 12 08:30:24 2006
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
X-Original-To: freebsd-net@freebsd.org
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id E7B3216A4DD
	for <freebsd-net@freebsd.org>; Wed, 12 Jul 2006 08:30:24 +0000 (UTC)
	(envelope-from b.candler@pobox.com)
Received: from proof.pobox.com (proof.pobox.com [207.106.133.28])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 88ED243D45
	for <freebsd-net@freebsd.org>; Wed, 12 Jul 2006 08:30:24 +0000 (GMT)
	(envelope-from b.candler@pobox.com)
Received: from proof (localhost [127.0.0.1])
	by proof.pobox.com (Postfix) with ESMTP id 1BBE623934;
	Wed, 12 Jul 2006 04:30:24 -0400 (EDT)
Received: from mappit.local.linnet.org (212-74-113-67.static.dsl.as9105.com
	[212.74.113.67])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by proof.sasl.smtp.pobox.com (Postfix) with ESMTP id D7933601EA;
	Wed, 12 Jul 2006 04:30:22 -0400 (EDT)
Received: from lists by mappit.local.linnet.org with local (Exim 4.61
	(FreeBSD)) (envelope-from <b.candler@pobox.com>)
	id 1G0a6u-0000gc-80; Wed, 12 Jul 2006 09:30:20 +0100
Date: Wed, 12 Jul 2006 09:30:20 +0100
From: Brian Candler <B.Candler@pobox.com>
To: Ensel Sharon <user@dhp.com>
Message-ID: <20060712083020.GA2607@uk.tiscali.com>
References: <Pine.LNX.4.21.0607101838530.12027-100000@shell.dhp.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Pine.LNX.4.21.0607101838530.12027-100000@shell.dhp.com>
User-Agent: Mutt/1.4.2.1i
Cc: freebsd-net@freebsd.org
Subject: Re: counting (not) blocks of IPs in ipfw - please help
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 12 Jul 2006 08:30:25 -0000

On Mon, Jul 10, 2006 at 06:40:50PM -0400, Ensel Sharon wrote:
> I can't seem to get ipfw to handle a rule like this:
> 
> 
> ipfw add 00100 count ip from any not { 10.20.0.0/16 or 10.30.0.0/16 } to
> any via em0 in
> 
> The error is:
> 
> ipfw: missing ``to''
> ipfw: unrecognised option [-1] 10.20.0.0/16

Firstly, "from any XXX" is giving two different 'from' items. I guess you
meant "from not { 10.20.0.0/16 or 10.30.0.0/16 }". But that doesn't work
either:

# ipfw add 00100 count ip from not { 10.20.0.0/16 or 10.30.0.0/16 } to any via fxp0 in
ipfw: hostname ``{'' unknown

According to the manpage, that syntax is not allowed. Notice:

           [proto from src to dst] [options]

...

     src and dst: {addr | { addr or ... }} [[not] ports]

...

     addr: [not] {any | me | me6 table(number[,value]) | addr-list | addr-set}

i.e. "not { x or y }" is not a valid 'src'

The obvious boolean transformation doesn't work, since "and" is not allowed
either: i.e.

# ipfw add 00100 count ip from { not 10.20.0.0/16 and not 10.30.0.0/16 } to any via fxp0 in
ipfw: missing ")"

I think you need to use a table. Or choose another workaround, e.g. two
rules with separate counters, or two rules which jump to another rule which
does the counting.

Regards,

Brian.