Date: Mon, 21 Feb 2000 15:44:34 +0100 (CET) From: "Nicolai Petri (ML)" <nppmf@swamp.dk> To: Luigi Rizzo <luigi@info.iet.unipi.it> Cc: freebsd-ipfw@FreeBSD.ORG Subject: Re: keep-state option in CURRENT. Message-ID: <Pine.BSF.4.21.0002211532470.31151-100000@distortion.dk> In-Reply-To: <200002211415.PAA93177@info.iet.unipi.it>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, 21 Feb 2000, Luigi Rizzo wrote:
> rule 1100 above is not even legal.
sorry. I forgot the tcp.
>
> You should write the following rules
>
> ipfw add 100 check-state
> ipfw add 200 deny tcp from any to any established
> ipfw add 1000 allow tcp from ${MYIPADDR} to any setup keep-state
> ipfw add 1100 allow tcp from any to ${MYIPADDR} setup keep-state
> ipfw add 2000 deny tcp from any to any
>
> and then something else for other udp/tcp packets perhaps
>
> ipfw add 1200 allow udp from ${MYIPADDR} to any keep-state
Perfekt. I do not know why i missed the check-state rule.. Would it be an
idea to check if there is a check-state entry ? I think it could bite a
lot of people because the firewall simply fills up the ruletable and never
clears it. (It looks really nasty on the console btw.)
What about the invalid state messages i recieve .. Is it something I
should trace or is it simply not handle 100% yet?
But else it works fine. Great work..
---
Nicolai Petri
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ipfw" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0002211532470.31151-100000>