Date: Mon, 15 Apr 2013 21:04:32 +0200 From: Spil Oss <spil.oss@gmail.com> To: Ian Smith <smithi@nimnet.asn.au> Cc: freebsd-ipfw@freebsd.org, Michael Sierchio <kudzu@tenebras.com> Subject: Re: Problems with ipfw/natd and axe(4) Message-ID: <CAEJyAvP-4FZ7eZ0o4c3qMzC0nY_gT4GfS3KjBVQiuzNY3aXz4Q@mail.gmail.com> In-Reply-To: <20130415160625.K56386@sola.nimnet.asn.au> References: <CAEJyAvOZ6fW0i3yT_D4fH1huje-qsJwA7GGeXqAO1PKzge-YNw@mail.gmail.com> <20130415015850.Y56386@sola.nimnet.asn.au> <CAHu1Y73Xu64NY1B=idaKmHKDGOB3AHbcXKi4A48-SNkhJrMy6Q@mail.gmail.com> <20130415160625.K56386@sola.nimnet.asn.au>
index | next in thread | previous in thread | raw e-mail
[-- Attachment #1 --]
Hi all,
Network dumps as promised
On 172.17.2.1:
tcpdump -p -i bridge0 -s 0 -w ssh-fail.pcap host not 172.17.2.167
>From 172.17.2.1 I ran
telnet 172.17.2.111/157 22
In Wireshark I trimmed the capture a bit further with expression
'not stp and not http'
Initial setup (ue0 ext, re0 int, rule 10 to allow ssh)
-> ue0-ssh-success.pcap
Removed rule 10
-> ue0-ssh-fail.pcap
Switched re0 and ue0, default ruleset (without 10)
-> re0-ssh-success.pcap
According to YungHyeong the sample ASIX NIC he has works normally when
checksumming is disabled.
Kind regards,
Spil.
On Mon, Apr 15, 2013 at 8:25 AM, Ian Smith <smithi@nimnet.asn.au> wrote:
> On Sun, 14 Apr 2013 10:34:06 -0700, Michael Sierchio wrote:
> > On Sun, Apr 14, 2013 at 10:26 AM, Ian Smith <smithi@nimnet.asn.au>
> wrote:
> >
> > > 'allow ip' aka 'allow all' doesn't usually take a port number, which
> > > applies only to tcp and udp.
> >
> > It does in ipfw - in which case it means ( udp | tcp )
>
> You're quite right, and my assumption that it would also permit icmp
> was quite wrong, after a quick test.
>
> Which appears to leave the bypassed divert not working with rx/txcsum
> the only viable suspect. The ruleset is otherwise 'out of the box'.
>
> Does anyone know whether this is an issue with libalias(3) generally -
> in which case using nat instead of divert shouldn't help - or just with
> natd in particular?
>
> cheers, Ian
>
[-- Attachment #2 --]
ò HlQZS J J `nB[Sf E <*@ @ o5 tY `
w HlQ@Z J J f `nB[S E < r@ @ݷo 52TctZw
w HlQZ B B `nB[Sf E 4,@ @ o5 tZ2Tdw
w! HlQx q q f `nB[S E c s@ @ݏo 52TdtZa
w!SSH-2.0-OpenSSH_6.1_hpn13v11 FreeBSD-20120901
HlQ!( B B `nB[Sf E 4C@ @ ެo5 tZ2T
w
HlQ B B `nB[Sf E 4+@ @o5 tZ2T
w
HlQ B B f `nB[S E 4 t@ @ݽo 52Tt[q
w HlQ B B f `nB[S E 4 u@ @ݼo 52Tt[q
w HlQL B B `nB[Sf E 4-@ @o5 t[2Tq
w
[-- Attachment #3 --]
ò HlQ J J `nB[Sf E <Q~@ @o\ m{
yT HlQ J J f `nB[S E < @ @ݩo \km|\
EryTHlQ J J `nB[Sf E <Sf@ @o\ m{ a
y HlQ J J f `nB[S E < @ @ݨo \km|\
EryTHlQ> J J f `nB[S E < @ @ݧo \km|\
Ery HlQ J J f `nB[S E < @ @ݦo \km|\
Ery HlQ J J `nB[Sf E <UY@ @o\ m{ z
y HlQ J J f `nB[S E < @ @ݥo \km|\
EryHlQ
J J f `nB[S E < @ @ݤo \km|\
EryHlQ > > `nB[Sf E 0W@ @o\ m{ p HlQ| B B f `nB[S E 4 @ @ݫo \km|\
[-- Attachment #4 --]
ò JlQ J J @af E <@ @77^ @z -
, JlQj! J J f @a E < @ @F ^:瞮@{Q
eyS,JlQ! B B @af E 4@ @7>^ @{:
,eySJlQb q q f @a E c @ @ ^:螮@{y
eyg,SSH-2.0-OpenSSH_6.1_hpn13v11 FreeBSD-20120901
JlQe B B @af E 4@ @7 ^ @{;T
-jeygJlQ B B @af E 4q@ @3^ @{;
C*eygJlQΔ B B f @a E 4 @ @L ^;@|l
eC*JlQw B B f @a E 4 @ @K ^;@|k
eC*JlQҘ B B @af E 4r@ @3^ @|;j
C+e
help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAEJyAvP-4FZ7eZ0o4c3qMzC0nY_gT4GfS3KjBVQiuzNY3aXz4Q>