Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 21 Feb 2000 15:44:34 +0100 (CET)
From:      "Nicolai Petri (ML)" <nppmf@swamp.dk>
To:        Luigi Rizzo <luigi@info.iet.unipi.it>
Cc:        freebsd-ipfw@FreeBSD.ORG
Subject:   Re: keep-state option in CURRENT.
Message-ID:  <Pine.BSF.4.21.0002211532470.31151-100000@distortion.dk>
In-Reply-To: <200002211415.PAA93177@info.iet.unipi.it>

next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, 21 Feb 2000, Luigi Rizzo wrote:

> rule 1100 above is not even legal.
sorry. I forgot the tcp.

> 
> You should write the following rules
> 
> 	ipfw add 100 check-state
> 	ipfw add 200 deny tcp from any to any established
> 	ipfw add 1000 allow tcp from  ${MYIPADDR} to any setup keep-state
> 	ipfw add 1100 allow tcp from  any to ${MYIPADDR} setup keep-state
> 	ipfw add 2000 deny tcp from any to any
> 
> and then something else for other udp/tcp packets perhaps
> 
> 	ipfw add 1200 allow udp from ${MYIPADDR} to any keep-state

Perfekt. I do not know why i missed the check-state rule.. Would it be an
idea to check if there is a check-state entry ? I think it could bite a
lot of people because the firewall simply fills up the ruletable and never
clears it. (It looks really nasty on the console btw.)

What about the invalid state messages i recieve .. Is it something I
should trace or is it simply not handle 100% yet? 

But else it works fine. Great work..

---
Nicolai Petri




To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ipfw" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0002211532470.31151-100000>