From owner-freebsd-current@FreeBSD.ORG Tue Jun 10 21:32:00 2003 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id BCEB837B404 for ; Tue, 10 Jun 2003 21:32:00 -0700 (PDT) Received: from dan.emsphone.com (dan.emsphone.com [199.67.51.101]) by mx1.FreeBSD.org (Postfix) with ESMTP id 022F143FCB for ; Tue, 10 Jun 2003 21:32:00 -0700 (PDT) (envelope-from dan@dan.emsphone.com) Received: (from dan@localhost) by dan.emsphone.com (8.12.9/8.12.9) id h5B4Vxgg014068; Tue, 10 Jun 2003 23:31:59 -0500 (CDT) (envelope-from dan) Date: Tue, 10 Jun 2003 23:31:59 -0500 From: Dan Nelson To: Andre Guibert de Bruet Message-ID: <20030611043159.GC48233@dan.emsphone.com> References: <20030611001220.X56112@alpha.siliconlandmark.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20030611001220.X56112@alpha.siliconlandmark.com> X-OS: FreeBSD 5.1-CURRENT X-message-flag: Outlook Error User-Agent: Mutt/1.5.4i cc: current@freebsd.org Subject: Re: ipfw's "me" keyword X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Jun 2003 04:32:01 -0000 In the last episode (Jun 11), Andre Guibert de Bruet said: > Hi, > > I've been fooling around a bit with IPFW2 and I came across interesting > behavior with regards to the "me" keyword. It appears as if smb broadcasts > (UDP 137,138) do not get matched when denying packets with a rule similar > to the following: > deny udp from 192.168.1.0/24 to me dst-port 137,138 > > I have a rule right after the one above which logs and I'm getting the > following in my syslog: > Jun 11 00:16:04 bling kernel: ipfw: 65530 Reject UDP 192.168.1.40:138 192.168.1.255:138 in via dc0 > > Now I realize that the broadcast address doesn't match the network > card's IP address, which is why the packet isn't getting matched. But > do we really want this behavior? Don't broadcasts affect all machines > on the subnet and therefore qualify for "me" matching? "me" was more designed for allow rules when you have a dynamic IP. It lets you set up rules that are guaranteed to work no matter what your current IP is. Does this do what you want: deny udp from 192.168.1.0/24 to any dst-port 137,138 in via dc0 -- Dan Nelson dnelson@allantgroup.com