Date: Mon, 09 Aug 2004 20:35:27 +0400 From: anatoly@relcom.ru To: current@freebsd.org Subject: strange ipfilter's behavior Message-ID: <4117A7CF.5080303@relcom.ru>
next in thread | raw e-mail | index | archive | help
hey, after few current cvsup's ipfilter doesnt work properly. Seems none saw this problem. After boot process passed it seems ipfilter rules are not working properly (but they're loaded and you can see them via ipfstat -io). rules themself are applied for tun0 with ppp on it. If I run ipf -Fa -f /etc/ipf.conf manually ipfilter start working as it ought to. (same situation with ipnat) Question is.. i missed something in recent /etc/rc updates or its a bug? uname -a: FreeBSD lifebook 5.2-CURRENT FreeBSD 5.2-CURRENT #0: Mon Aug 9 14:35:50 MSD 2004 root@lifebook:/usr/obj/usr/src/sys/LIFEBOOK i386 /etc/rc.conf: ipfilter_enable="YES" ipfilter_program="/sbin/ipf" ipfilter_rules="/etc/ipf.conf" ipfilter_flags="" ipnat_enable="YES" # Set to YES to enable ipnat functionality ipnat_program="/sbin/ipnat" # where the ipnat program lives ipnat_rules="/etc/ipnat.conf" # rules definition file for ipnat ipnat_flags="" # additional flags for ipnat ipmon_enable="YES" ipmon_program="/sbin/ipmon" # where the ipfilter monitor program lives ipmon_flags="-Ds" # typically "-Ds" or "-D /var/log/ipflog" /etc/ipf.conf: (pretty ugly) count out on tun0 from any to any count in on tun0 from any to any pass out quick on tun0 proto tcp from any to any keep state pass out quick on tun0 proto icmp from any to any keep state pass out quick on tun0 proto udp from any to any keep state block return-icmp in log quick on tun0 proto udp from any to any block return-icmp(proto-unr) in log quick on tun0 proto icmp from any to any block return-rst in log quick on tun0 proto tcp from any to any
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4117A7CF.5080303>