Re: change packets with IPFW divert

2016-10-18 Thread Ian Smith 
On Tue, 18 Oct 2016 14:21:50 +, Shawn Bakhtiar wrote:
 > On Oct 18, 2016, at 6:49 AM, Samira Nazari 
 > > wrote:
 > > Hello every one,
 > > When we diverte packets to the specified port with "IPFW divert" ,
 > > we can change it and re-sent to the kernel?

 > Not sure what you mean by change it but:
 > 
 > "Divert sockets are similar to raw IP sockets, except that they can 
 > be bound to a specific divert port via the bind(2) system call.  The 
 > IP address in the bind is ignored; only the port number is 
 > significant.  A divert socket bound to a divert port will receive all 
 > packets diverted to that port by some (here unspecified) kernel 
 > mechanism(s).  Packets may also be written to a divert port, in which 
 > case they re-enter kernel IP packet processing."
 > 
 > -- SRC: 
 > https://www.freebsd.org/cgi/man.cgi?query=divert=4=0=FreeBSD+10.3-RELEASE+and+Ports

Apart from divert(4), most likely the best example is the natd(8) code, 
which modifies packet source or destination addresses and (maybe) ports.

Ignoring the NAT processing - or not, as appropriate - the way natd uses 
divert sockets both to receive packets from ipfw and later (perhaps) to 
reinject them for further processing should show clearly how it's done.

cheers, Ian
___
freebsd-ipfw@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "freebsd-ipfw-unsubscr...@freebsd.org"

Re: change packets with IPFW divert

2016-10-18 Thread Shawn Bakhtiar 

On Oct 18, 2016, at 6:49 AM, Samira Nazari 
> wrote:

Hello every one,

When we  diverte packets to the specified port with "IPFW divert" , we can
change it and re-sent to the kernel?
___
freebsd-ipfw@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "freebsd-ipfw-unsubscr...@freebsd.org"


Not sure what you mean by change it but:

"Divert sockets are similar to raw IP sockets, except that they can be bound to 
a specific divert port via the bind(2) system call.  The IP address in the bind 
is ignored; only the port number is significant.  A divert socket bound to a 
divert port will receive all packets diverted to that port by some (here 
unspecified) kernel mechanism(s).  Packets may also be written to a divert 
port, in which case they re-enter kernel IP packet processing."

-- SRC: 
https://www.freebsd.org/cgi/man.cgi?query=divert=4=0=FreeBSD+10.3-RELEASE+and+Ports





___
freebsd-ipfw@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "freebsd-ipfw-unsubscr...@freebsd.org"

[Bug 209680] ipfw: when enabled, net connections time out/ssh results in "broken pipe"

2016-10-18 Thread bugzilla-noreply 
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209680

--- Comment #10 from Michael Osipov <1983-01...@gmx.net> ---
This patch does not work for me. Same issue happens even with the patch and if
I switch from graid3 to ZFS raidz, everything is fine. It must be the geom
class in my case.

-- 
You are receiving this mail because:
You are the assignee for the bug.
___
freebsd-ipfw@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "freebsd-ipfw-unsubscr...@freebsd.org"