From owner-freebsd-ipfw@FreeBSD.ORG Mon Sep 20 06:25:23 2004 Return-Path: Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B7B1316A4CE for ; Mon, 20 Sep 2004 06:25:23 +0000 (GMT) Received: from mailhost.wsf.at (server202.serveroffice.com [217.196.72.202]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3788B43D2D for ; Mon, 20 Sep 2004 06:25:22 +0000 (GMT) (envelope-from tw@wsf.at) Received: from mailhost.wsf.at (root@localhost)i8K6LkIh020325 for ; Mon, 20 Sep 2004 08:21:46 +0200 (CEST) (envelope-from tw@wsf.at) Received: from mailhost.wsf.at (http.wsf.at [217.196.72.203]) i8K6Lhdn020317; Mon, 20 Sep 2004 08:21:43 +0200 (CEST) (envelope-from tw@wsf.at) Date: Mon, 20 Sep 2004 06:21:42 -0000 To: "J.T. Davies" , freebsd-ipfw@freebsd.org From: Thomas Wolf X-Mailer: twiggi 1.10.3 Message-ID: <20040920082142.eeekl07rke80s4@.mailhost.wsf.at> MIME-Version: 1.0 Content-Disposition: inline Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: Re: Dynamic rules & stats X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: tw@wsf.at List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Sep 2004 06:25:23 -0000 "J.T. Davies" schrieb: > Please someone smack me around and correct me if I'm mistaken. > > I'm using 5.1 Release p13 > > I've got IPFW2 enabled. Stateless & stateful rules are working correctly. > I'm trying to incorporate/"upgrade" to dynamic rulesets, but I'm confused. > > I've got the following rules: > > 1000 check-state > 2000 allow tcp from any 1024-65535 to mysvrIP 25,110 in via outsideinterface > setup keep-state > > > Now, when I check mail from an outside client (mail transfer is successful), > and then I do IPFW SHOW, the traffic counters for rule 2000 are ever > increasing, but 1000 stays at 0. Every mail transfer (whether POP3 or SMTP) > increments 2000, but never 1000. > > Is this correct? I *thought* that this should work somewhat like the > "setup" and the "established" methods of a stateful firewall configuration. No need to worry. For dynamic rules, it's always the parent rule (which 'created' the dynamic one) where the counters are incremented (in your setup 2000) > If I remark rule 1000...traffic still passes through. "If no check-state rule is found, the dynamic ruleset is checked at the first keep-state or limit rule." (man ipfw) Thomas -- Thomas Wolf Wiener Software Fabrik Dubas u. Wolf GMBH 1050 Wien, Mittersteig 4