Date: Sun, 14 Oct 2001 18:16:05 +0200 (CEST) From: Oliver Fromme <olli@secnetix.de> To: freebsd-stable@FreeBSD.ORG Subject: Re: IPFW or IPFILTER? Message-ID: <200110141616.f9EGG5x37636@lurza.secnetix.de> In-Reply-To: <20011014180756.A17546@adv.devet.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Arjan de Vet <devet@devet.org> wrote: > In article <20011012184741.D6274@blossom.cjclark.org> you write: > [...] > >Will let you ping the rest of the word and even let Windows-style > >traceroutes work, but that's because it works like this: > > > > <src_ip>:<src_icmp_type.src_icmp_code> -> <dst_ip> > > > >Creates a dynamic rule, > > > > pass icmp from <dst_ip> to <src_ip> > > > >That is, _any_ ICMP from <dst_ip> to <src_ip> is passed for the > >dynamic's rule lifetime. > > IIRC ipfilter does not allow '_any_ ICMP' in such a case: if you send an > 'ICMP echo' with keep-state then only 'ICMP echo reply' packets will be > allowed to pass through. That's bad, because you usually want to see other types of ICMP replies, too, such as TTL exceeded, host unreachable, communication prohibited etc. Regards Oliver -- Oliver Fromme, secnetix GmbH & Co KG, Oettingenstr. 2, 80538 München Any opinions expressed in this message may be personal to the author and may not necessarily reflect the opinions of secnetix in any way. "All that we see or seem is just a dream within a dream" (E. A. Poe) To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200110141616.f9EGG5x37636>