Hi, I'm using IPFW on a Jail server. I have system-wide rules set up at the top of my rule-set, like this:
00100 allow ip from any to any via lo0 00101 check-state 00102 allow icmp from me to any keep-state 00103 allow udp from me to any keep-state 00104 allow tcp from me to any keep-state 00105 allow icmp from 1.2.0.0/16 to me keep-state And then each Jail server has a set of rules, like this: 01000 allow tcp from 1.2.0.0/16 to 1.2.3.4 dst-port 22 keep-state 01001 allow tcp from any to 1.2.3.4 dst-port 80 keep-state 01002 allow tcp from any to 1.2.3.4 dst-port 443 keep-state What I've been noticing is that the web server is accumulating a large number of dynamic rules that are not going away, and consequently FreeBSD is keeping a large number of sockets open for long periods of time, which are sending out tons of ACK packets to remote hosts that connected to our web server a long time ago, and have long since closed their side of the TCP connection. I've attached two graphs: one shows the number of dynamic firewall rules over time, and the other shows the number of open sockets over time. Each time I re-load my firewall rules (which includes a "flush"), the graphs drop back down to a reasonable number (hence the sawtooth effect you see in the graph). Can anyone help me understand what is going on here? Have I found some sort of bug, or do I have my firewall incorrectly configured? -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Tim Gustafson [email protected] Baskin School of Engineering 831-459-5354 UC Santa Cruz Baskin Engineering 317B -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
_______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw To unsubscribe, send any mail to "[email protected]"
