ipfw amd bridge

2009-03-15 Thread Olivier Nicole
Hi, I remember reqading in the past (4.x) that on a machine with bridged interfaces, only layer 2 rules of ipfw would apply. Is this still the case with 6.4, 7.1? best regards, Olivier ___ freebsd-ipfw@freebsd.org mailing list

Re: ipfw amd bridge

2009-03-15 Thread Julian Elischer
Olivier Nicole wrote: Hi, I remember reqading in the past (4.x) that on a machine with bridged interfaces, only layer 2 rules of ipfw would apply. not quite. there are rules that do not work when called from a layer two point. e.g. divert does not work, nor does 'fwd' (without patches). Rules

Re: ipfw amd bridge

2009-03-15 Thread Olivier Nicole
Thanks, I remember reqading in the past (4.x) that on a machine with bridged interfaces, only layer 2 rules of ipfw would apply. not quite. there are rules that do not work when called from a layer two point. e.g. divert does not work, nor does 'fwd' (without patches). And what would be

Re: ipfw amd bridge

2009-03-15 Thread Julian Elischer
Olivier Nicole wrote: Thanks, I remember reqading in the past (4.x) that on a machine with bridged interfaces, only layer 2 rules of ipfw would apply. not quite. there are rules that do not work when called from a layer two point. e.g. divert does not work, nor does 'fwd' (without patches).

Re: keep-state rules inadequately handles big UDP packets or fragmented IP packets?

2009-03-15 Thread Luigi Rizzo
On Sun, Mar 15, 2009 at 12:38:37PM +0300, Sergey Matveychuk wrote: Dmitriy Demidov wrote: Hi Luigi. Thank you for answer. It is a big surprise for me that reassembling of IP datagrams is done not *before* they go into firewall, but *after* :( But what's wrong with it? A fragment got from

Re: keep-state rules inadequately handles big UDP packets or fragmented IP packets?

2009-03-15 Thread Dmitriy Demidov
On Sunday 15 March 2009, Sergey Matveychuk wrote: Dmitriy Demidov wrote: Hi Luigi. Thank you for answer. It is a big surprise for me that reassembling of IP datagrams is done not *before* they go into firewall, but *after* :( But what's wrong with it? A fragment got from net, pass

Re: keep-state rules inadequately handles big UDP packets or fragmented IP packets?

2009-03-15 Thread Sergey Matveychuk
Sergey Matveychuk wrote: Luigi Rizzo wrote: On Sun, Mar 15, 2009 at 12:38:37PM +0300, Sergey Matveychuk wrote: Dmitriy Demidov wrote: Hi Luigi. Thank you for answer. It is a big surprise for me that reassembling of IP datagrams is done not *before* they go into firewall, but *after* :( But