Date: Fri, 23 Apr 2004 07:28:39 -0700 (PDT) From: Andre Oppermann <andre@FreeBSD.org> To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org Subject: cvs commit: src/sbin/ipfw ipfw.8 ipfw2.c Message-ID: <200404231428.i3NESdcd063836@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
andre 2004/04/23 07:28:39 PDT
FreeBSD src repository
Modified files:
sbin/ipfw ipfw.8 ipfw2.c
Log:
Add the option versrcreach to verify that a valid route to the
source address of a packet exists in the routing table. The
default route is ignored because it would match everything and
render the check pointless.
This option is very useful for routers with a complete view of
the Internet (BGP) in the routing table to reject packets with
spoofed or unrouteable source addresses.
Example:
ipfw add 1000 deny ip from any to any not versrcreach
also known in Cisco-speak as:
ip verify unicast source reachable-via any
Reviewed by: luigi
Revision Changes Path
1.143 +17 -1 src/sbin/ipfw/ipfw.8
1.47 +11 -1 src/sbin/ipfw/ipfw2.c
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200404231428.i3NESdcd063836>