From owner-freebsd-questions@freebsd.org Mon May 24 14:54:33 2021 Return-Path: Delivered-To: freebsd-questions@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 140C563643D for ; Mon, 24 May 2021 14:54:33 +0000 (UTC) (envelope-from kldunn@hiwaay.net) Received: from mail.hiwaay.net (mail.hiwaay.net [216.180.158.37]) by mx1.freebsd.org (Postfix) with ESMTP id 4FpgGb2NFXz4kWs for ; Mon, 24 May 2021 14:54:31 +0000 (UTC) (envelope-from kldunn@hiwaay.net) Received: (qmail 5122 invoked from network); 24 May 2021 14:54:25 -0000 Received: from 50-83-57-148.client.mchsi.com (HELO illiac.kad-hg.org) (kldunn@hiwaay.net@50.83.57.148) by mail.hiwaay.net with (DHE-RSA-AES256-GCM-SHA384 encrypted) SMTP (edfa09a6-bc9f-11eb-b2e2-e388b1081ee1); Mon, 24 May 2021 10:54:25 -0400 Date: Mon, 24 May 2021 09:54:24 -0500 (CDT) From: Karl Dunn Reply-To: Karl Dunn To: freebsd-questions@freebsd.org, Valeri Galtsev Subject: Re: After upgrade to 13.0-RELEASE ipfw locks the boxes Message-ID: <1e9112d7-2b86-568c-86b4-ee44e4cfd6c@illiac.kad-hg.org> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed X-MagicMail-OS: FreeBSD 9.x or newer X-MagicMail-UUID: edfa09a6-bc9f-11eb-b2e2-e388b1081ee1 X-MagicMail-Authenticated: kldunn@hiwaay.net X-MagicMail-SourceIP: 50.83.57.148 X-MagicMail-RegexMatch: 1 X-MagicMail-EnvelopeFrom: X-Rspamd-Queue-Id: 4FpgGb2NFXz4kWs X-Spamd-Bar: +++ Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=none (mx1.freebsd.org: domain of kldunn@hiwaay.net has no SPF policy when checking 216.180.158.37) smtp.mailfrom=kldunn@hiwaay.net X-Spamd-Result: default: False [3.87 / 15.00]; HAS_REPLYTO(0.00)[kldunn@hiwaay.net]; FAKE_REPLY(1.00)[]; REPLYTO_EQ_FROM(0.00)[]; FROM_HAS_DN(0.00)[]; TO_DN_SOME(0.00)[]; ARC_NA(0.00)[]; NEURAL_HAM_LONG(-0.13)[-0.131]; MIME_GOOD(-0.10)[text/plain]; DMARC_NA(0.00)[hiwaay.net]; RBL_DBL_DONT_QUERY_IPS(0.00)[216.180.158.37:from]; AUTH_NA(1.00)[]; NEURAL_SPAM_MEDIUM(1.00)[0.998]; SPAMHAUS_ZRD(0.00)[216.180.158.37:from:127.0.2.255]; TO_MATCH_ENVRCPT_SOME(0.00)[]; NEURAL_SPAM_SHORT(1.00)[1.000]; RCPT_COUNT_TWO(0.00)[2]; R_SPF_NA(0.00)[no SPF record]; RCVD_NO_TLS_LAST(0.10)[]; FROM_EQ_ENVFROM(0.00)[]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:395532, ipnet:216.180.158.0/23, country:US]; RCVD_COUNT_TWO(0.00)[2]; MAILMAN_DEST(0.00)[freebsd-questions] X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 May 2021 14:54:33 -0000 On 5/23/21 11:36 AM CDT, Valeri Galtsev wrote: Dear All, as a lazy person, before I start rewriting all my ipfw scripts I decided to ask somebody?s else wisdom. It is possible that I mi ssed something I have to do related to ipfw in this particular upgrade: from 12.2-RELEASE to 13.0-RELEASE I have a bunch of boxes that I have rather similar (though not identical) ipfw scripts on, these were written a while back (arou nd 8.x-RELEASE), and were just slightly modified on some occasions. None of previous upgrades 8 ?> 9; 9 ?> 10,.. 11 ?> 12 led to any problems as far as ipfw is concerned. I was just rebooting the machine after kernel upgrade, and after userland upgrade and all pkg reinstallation, I was testing things as usually, no problem with ipfw. After this upgrade: to 13.0-RELEASE, ipfw effectively locks any remote access to the box (except for ping). My first guess was I just missed relevant part in release notes (which I must confess I rarely read carefully), but I don?t find anything special re lated to ipfw. I hope, someone points me too obvious ?pilot error? I made. Before I start re-creating ipfw scripts, and testing every line in t hem as did when I was learning it when first started playing with ipfw. Thanks in advance for all your answers. Valeri ++++++++++++++++++++++++++++++++++++++++ Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247 ++++++++++++++++++++++++++++++++++++++++ Valeri: A wild and unlikely guess (because ping works and nothing else does): Interfaces name(s) have changed, e.g. what was em0 is now em1. It might help to post relevant parts (or all) of dmesg, rc.conf and loader.conf, and the (sanitized) ipfw rules. I am on the digest for freebsd-auestions, so I will get your response quicker if you copy me at kdunn@acm.org. -- Karl Dunn kdunn@acm.org