From owner-freebsd-ipfw@FreeBSD.ORG Sat Jan 17 15:13:54 2004 Return-Path: Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D7F9B16A4CE; Sat, 17 Jan 2004 15:13:54 -0800 (PST) Received: from mta10.adelphia.net (mta10.adelphia.net [68.168.78.202]) by mx1.FreeBSD.org (Postfix) with ESMTP id AA41E43D39; Sat, 17 Jan 2004 15:13:52 -0800 (PST) (envelope-from fbsd_user@a1poweruser.com) Received: from barbish ([67.20.101.103]) by mta13.adelphia.net (InterMail vM.5.01.06.05 201-253-122-130-105-20030824) with SMTP id <20040117231010.VIIA8989.mta13.adelphia.net@barbish>; Sat, 17 Jan 2004 18:10:10 -0500 From: "fbsd_user" To: "freebsd-questions@FreeBSD. ORG" Date: Sat, 17 Jan 2004 18:10:09 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0) X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Importance: Normal cc: freebsd-ipfw@freebsd.org Subject: 5.2 + ipfw2 + keep-state rules Bug X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: fbsd_user@a1poweruser.com List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Jan 2004 23:13:55 -0000 Using an fresh install of FBSD 5.2 RC2 I am trying to get stateful rules to function. For some reason ipfw2 seems to be issuing an ICMP:3.3 packet to my ISP's dns. Here is my rules file # Flush out the list before we begin. /sbin/ipfw -q -f flush # Set rules command prefix cmd="ipfw -q add" # Internal gateway housekeeping $cmd 00100 allow all from any to any via lo0 # allow all localhost $cmd 00105 allow all from any to any via xl0 # allow all local Lan $cmd 00110 check-state log logamount 500 $cmd 00150 divert natd all from any to any $cmd 00170 count log logamount 500 all from any to any $cmd 00310 allow log logamount 500 tcp from any to any 53 out via rl0 setup keep-state $cmd 00311 allow log logamount 500 udp from any to any 53 out via rl0 keep-state $cmd 00315 allow log logamount 500 tcp from any to any 80 out via rl0 setup keep-state $cmd 00350 allow log logamount 500 icmp from any to any out via rl0 keep-state $cmd 00500 deny log logamount 500 all from any to any Here is the ipfw2 log Ipfw: 110 UNKNOWN UDP 10.0.10.5:1181 208.206.15.11:53 out via rl0 Ipfw: 170 Count UDP 67.20.101.103:1181 208.206.15.11:53 out via rl0 Ipfw: 311 Accept UDP 67.20.101.103:1181 208.206.15.11:53 out via rl0 Ipfw: 110 UNKNOWN UDP 208.206.15.11:53 67.20.101.103:1181 in via rl0 Ipfw: 311 Accept UDP 208.206.15.11:53 67.20.101.103:1181 in via rl0 Ipfw: 110 UNKNOWN ICMP:3.3 67.20.101.103 208.206.15.11 out via rl0 Ipfw: 170 Count ICMP:3.3 67.20.101.103 208.206.15.11 out via rl0 Ipfw: 350 Accept ICMP:3.3 67.20.101.103 208.206.15.11 out via rl0 Ipfw: 110 UNKNOWN UDP 10.0.10.5:1181 208.206.15.11:53 out via rl0 Ipfw: 170 Count UDP 67.20.101.103:1181 208.206.15.11:53 out via rl0 Ipfw: 311 Accept UDP 67.20.101.103:1181 208.206.15.11:53 out via rl0 Ipfw: 110 UNKNOWN UDP 208.206.15.11:53 67.20.101.103:1181 in via rl0 Ipfw: 311 Accept UDP 208.206.15.11:53 67.20.101.103:1181 in via rl0 Ipfw: 110 UNKNOWN ICMP:3.3 67.20.101.103 208.206.15.11 out via rl0 Ipfw: 350 Accept ICMP:3.3 67.20.101.103 208.206.15.11 out via rl0 Ipfw: 110 UNKNOWN UDP 10.0.10.5:1181 208.206.15.12:53 out via rl0 Ipfw: 170 Count UDP 67.20.101.103:1181 208.206.15.12:53 out via rl0 Ipfw: 311 Accept UDP 67.20.101.103:1181 208.206.15.12:53 out via rl0 Ipfw: 110 UNKNOWN UDP 208.206.15.12:53 67.20.101.103:1181 in via rl0 Ipfw: 311 Accept UDP 208.206.15.12:53 67.20.101.103:1181 in via rl0 Ipfw: 110 UNKNOWN ICMP:3.3 67.20.101.103 208.206.15.12 out via rl0 Ipfw: 170 Count ICMP:3.3 67.20.101.103 208.206.15.12 out via rl0 Ipfw: 350 Accept ICMP:3.3 67.20.101.103 208.206.15.12 out via rl0 When I change the rules to use pass all just to test if there is something wrong with my ISP's dns server, everything works. So there is no reason for the icmp 3.3 packet. # Flush out the list before we begin. /sbin/ipfw -q -f flush # Set rules command prefix cmd="ipfw -q add" # Internal gateway housekeeping $cmd 00100 allow all from any to any via lo0 # allow all localhost $cmd 00105 allow all from any to any via xl0 # allow all local Lan $cmd 00150 divert natd all from any to any $cmd 00160 allow log logamount 500 all from any to any Log from about rules file Ipfw: 160 Accept UDP 67.20.101.103:1175 208.206.15.11:53 out via rl0 Ipfw: 160 Accept UDP 208.206.15.11:53 10.0.10.5:1175 in via rl0 Ipfw: 160 Accept TCP 67.20.101.103:1176 216.136.204.117:80 out via rl0 Ipfw: 160 Accept TCP 216.136.204.117:80 10.0.10.5:1176 in via rl0 Ipfw: 160 Accept TCP 67.20.101.103:1176 216.136.204.117:80 out via rl0 Ipfw: 160 Accept TCP 67.20.101.103:1176 216.136.204.117:80 out via rl0 Ipfw: 160 Accept TCP 216.136.204.117:80 10.0.10.5:1176 in via rl0 Ipfw: 160 Accept TCP 67.20.101.103:1176 216.136.204.117:80 out via rl0 Ipfw: 160 Accept TCP 216.136.204.117:80 10.0.10.5:1176 in via rl0 This looks like 5.2 ipfw2 bug to me. Any body explain why ipfw2 is doing this?