On 5.2.2003 17:16, "ryan beasley" <[EMAIL PROTECTED]> wrote:
> Assuming my understanding of the interface indexes is correct, I > would've expected something like > interfaces: in qfe0,qfe1 out qfe1,qfe0 where 192.168.2.12 is on qfe0 > and 212.238.176.190 on qfe1 Me too... I found a bug in ipfilter 3.4.29 that was related to resyncing ipf with "ipf -y" - each time the first input interface in each state entry got overwritten with the first output interface because of a small mistake in ip_state.c (is->is_ifpin is used in ip_statesync() where is->is_ifp[i] should be used). Darren knows about the bug; I'm not sure if it's fixed in 3.4.31, though. If "ipfboot reipf" executes "ipf -y", too, then Richard might be experiencing the same problem. Removing the "flags S" will cause a new state to be created even if the packet in question does not have the SYN flag set, so that sort of works around the problem by creating new states for existing connections. Just my $0.02... Greets, Manuel
