From owner-freebsd-questions Sun Feb 11 19:43:24 2001 Delivered-To: freebsd-questions@freebsd.org Received: from christel.heitec.net (christel.heitec.net [193.101.232.3]) by hub.freebsd.org (Postfix) with ESMTP id 9968237B401 for ; Sun, 11 Feb 2001 19:43:21 -0800 (PST) Received: from heitec.net (paladin.heitec.net [193.101.232.30]) by christel.heitec.net (Postfix) with ESMTP id CFA96B8102; Mon, 12 Feb 2001 04:43:19 +0100 (CET) Message-ID: <3A875BD7.DD4C3EC9@heitec.net> Date: Mon, 12 Feb 2001 04:43:19 +0100 From: Bernd Luevelsmeyer X-Mailer: Mozilla 4.04 [en] (WinNT; I) MIME-Version: 1.0 To: "Raymundo M. Vega" Cc: freebsd-questions@FreeBSD.ORG Subject: Re: Bridging and routing problem... References: <200102081626.LAA77762@gateway.vsl.cua.edu> <3A82FEA4.3666D366@home.com> <3A85DA55.10AF0B88@heitec.net> <3A863D8F.6F49A981@home.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Raymundo M. Vega wrote: > > Bernd Luevelsmeyer wrote: > > > > Raymundo M. Vega wrote: > > [...] > > > Rather than answer if bridging is better for your > > > network, I like to point thet you will have better > > > control in the firewall if you use it as a gateway. > > > > The packets must go through the firewall whether they are bridged or > > routed, so the firewall rules apply in both cases. IMHO there's no > > difference in the amount of control. > > > > Just read man bridge I did. I found "Non-IP packets are subject to the default ipfw rule (number 65535) which must be an allow rule if we want ARP and other non-IP packets to flow through the bridge.". But I also found "September 28, 1998". Since then, things have changed; please see /usr/src/etc/rc.firewall for the ARP passing rule. The rule allows you to have a default deny rule with a bridge. Have fun, Bernd To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message