From owner-freebsd-ipfw Mon Feb 21 6:35:38 2000 Delivered-To: freebsd-ipfw@freebsd.org Received: from distortion.dk (distortion.dk [195.249.147.156]) by hub.freebsd.org (Postfix) with ESMTP id 90C1837BD5A for ; Mon, 21 Feb 2000 06:35:32 -0800 (PST) (envelope-from nppmf@swamp.dk) Received: from localhost (nppmf@localhost) by distortion.dk (8.9.3/8.9.1) with ESMTP id PAA31497; Mon, 21 Feb 2000 15:44:34 +0100 (CET) (envelope-from nppmf@swamp.dk) Date: Mon, 21 Feb 2000 15:44:34 +0100 (CET) From: "Nicolai Petri (ML)" X-Sender: nppmf@distortion.dk To: Luigi Rizzo Cc: freebsd-ipfw@FreeBSD.ORG Subject: Re: keep-state option in CURRENT. In-Reply-To: <200002211415.PAA93177@info.iet.unipi.it> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-ipfw@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Mon, 21 Feb 2000, Luigi Rizzo wrote: > rule 1100 above is not even legal. sorry. I forgot the tcp. > > You should write the following rules > > ipfw add 100 check-state > ipfw add 200 deny tcp from any to any established > ipfw add 1000 allow tcp from ${MYIPADDR} to any setup keep-state > ipfw add 1100 allow tcp from any to ${MYIPADDR} setup keep-state > ipfw add 2000 deny tcp from any to any > > and then something else for other udp/tcp packets perhaps > > ipfw add 1200 allow udp from ${MYIPADDR} to any keep-state Perfekt. I do not know why i missed the check-state rule.. Would it be an idea to check if there is a check-state entry ? I think it could bite a lot of people because the firewall simply fills up the ruletable and never clears it. (It looks really nasty on the console btw.) What about the invalid state messages i recieve .. Is it something I should trace or is it simply not handle 100% yet? But else it works fine. Great work.. --- Nicolai Petri To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message