From owner-freebsd-ipfw@FreeBSD.ORG Tue Nov 30 18:42:00 2004 Return-Path: Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id DA3D616A4CF for ; Tue, 30 Nov 2004 18:42:00 +0000 (GMT) Received: from mail.jrv.org (rrcs-24-73-246-106.sw.biz.rr.com [24.73.246.106]) by mx1.FreeBSD.org (Postfix) with ESMTP id 79BF443D45 for ; Tue, 30 Nov 2004 18:42:00 +0000 (GMT) (envelope-from james@jrv.org) Received: from [127.0.0.1] (zippy.housenet.jrv [192.168.3.156]) (authenticated bits=0) by mail.jrv.org (8.12.11/8.12.10) with ESMTP id iAUIfZg9063263; Tue, 30 Nov 2004 12:41:37 -0600 (CST) (envelope-from james@jrv.org) Message-ID: <41ACBEDF.3020001@jrv.org> Date: Tue, 30 Nov 2004 12:41:35 -0600 From: "James R. Van Artsalen" User-Agent: Mozilla Thunderbird 0.9 (Windows/20041103) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Achim Patzner References: <41AC571E.2020503@jrv.org> <7261A3E8-42C2-11D9-AC2A-000A95A0BB90@bnc.net> In-Reply-To: <7261A3E8-42C2-11D9-AC2A-000A95A0BB90@bnc.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit cc: freebsd-ipfw@freebsd.org Subject: Re: FreeBSD 5.3 routing IPFW FWD'd packets? X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Nov 2004 18:42:01 -0000 Achim Patzner wrote: > Packets sent to the directly reachable net 192.168.254/8 (rule 64000) > seem to work. Is it possible that packets are somehow being routed > after being FWD'd by IPFW? > > The counters show that the rule is applied, too. Just the "fwd" part > is not happening. I'm suspicious of this code in netinet/ip_output.c: #ifdef IPFIREWALL_FORWARD ... fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL); if (fwd_tag) { if (!in_localip(ip->ip_src) && !in_localaddr(ip->ip_dst)) { dst = (struct sockaddr_in *)&ro->ro_dst; bcopy((fwd_tag+1), dst, sizeof(struct sockaddr_in)); m->m_flags |= M_SKIP_FIREWALL; m_tag_delete(m, fwd_tag); goto again; } else { m_tag_delete(m, fwd_tag); /* Continue. */ } } #endif passout: this seems to be where FWD is handled in this case. The problem is that 33 lines above I see this code: /* Jump over all PFIL processing if hooks are not active. */ if (inet_pfil_hook.ph_busy_count == -1) goto passout; It looks like me like IPFW forwarding isn't going to happen here unless there is some PFIL around.