Date: Mon, 30 Aug 2004 12:32:16 +0200 From: Oliver Brandmueller <ob@e-Gitt.NET> To: Andre Oppermann <andre@freebsd.org> Cc: current@freebsd.org Subject: Re: RELENG_5 ipfw problem Message-ID: <20040830103216.GA51110@e-Gitt.NET> In-Reply-To: <412F5307.5040005@freebsd.org> References: <20040827084306.GB74653@e-Gitt.NET> <412F276A.6080807@freebsd.org> <20040827141354.GC74653@e-Gitt.NET> <412F5307.5040005@freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Hello. On Fri, Aug 27, 2004 at 05:28:07PM +0200, Andre Oppermann wrote: > It detects a missing dummynet because it has to pass on configuration > options to dummynet and it can only do that if dummynet is loaded. For > FORWARD this is not the case. Here the ipfw code just tags the packet > for later treatment. And that later treatment is scattered through a > few places where we have to inspect each packet it carries this tag. > > >- How to enable it? > > Put "option IPFIREWALL_FORWARD" into your kernel configuration file and > recompile. I do now have IPFIREWALL and IPFIREWALL_FORWARD in the kernel and am not loading it as a module anymore. The dmesg now states: ipfw2 initialized, divert disabled, rule-based forwarding enabled, default to deny, logging disabled OK, fine. But do still have a problem: The rule is loaded an matched. Instead of just dropping the packet (as before, when rule based forwarding was disabled) the pakets are now accepted, but the forwarding does not work: 00200 fwd 192.168.25.1 tcp from 192.168.25.5 25 to 213.XXX.XXX.0/24 Is still see this on em0 (the public interface in the destination network metioned in rule 200): 12:26:09.674295 IP 192.168.25.5.smtp > 213.XXX.XXX.XXX.41424: S 3583621218:3583621218(0) ack 3993419222 win 65535 <mss 1460> # ipfw show 00200 2694 118536 fwd 192.168.25.1 tcp from 192.168.25.5 25 to 213.XXX.XXX.0/24 packets are accepted, but not forwarded. Can anyone else reproduce this? - Oliver -- | Oliver Brandmueller | Offenbacher Str. 1 | Germany D-14197 Berlin | | Fon +49-172-3130856 | Fax +49-172-3145027 | WWW: http://the.addict.de/ | | Ich bin das Internet. Sowahr ich Gott helfe. | | Eine gewerbliche Nutzung aller enthaltenen Adressen ist nicht gestattet! |
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040830103216.GA51110>