Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 3 Oct 2002 11:38:35 +0200
From:      Aragon Gouveia <aragon@phat.za.net>
To:        freebsd-security@FreeBSD.ORG
Subject:   Re: ipfw failing to "check-state"
Message-ID:  <20021003093835.GG46789@phat.za.net>
In-Reply-To: <200210030905.g9395RY99870@www.wsf.at>
References:  <20021003080725.GF46789@phat.za.net> <200210030905.g9395RY99870@www.wsf.at>

next in thread | previous in thread | raw e-mail | index | archive | help
| By Thomas Wolf <net@wsf.at>
|                                          [ 2002-10-03 11:05 +0200 ]
> Are you sure the traffic from 66.8.x.y 25 would be blocked without
> your default rule ? Regarding the counter on rule 100, 
> AFAIR ipfw did(does) never increment on the check-state rule but 
> on the 'parent' rule). From your example, everything looks just fine 
> and the temporary rules seem to be ok. Try adding 
> 1001 count tcp from 66.8.x.y 25 to any
> I am sure you will never see traffic at this point.

I think you're right. I added the count rule after the keep-state rule and
the counters didn't increment. I can't check with a deny just yet, but in
theory traffic shouldn't be blocked.

I must have been doing something braindead yesterday that caused connections
to be blocked. I assumed it was a problem with check-state when the
counters weren't incrementing. :)


Thanks,
Aragon

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20021003093835.GG46789>