From owner-freebsd-net@FreeBSD.ORG Sat Aug 2 17:31:43 2003 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3102C37B401 for ; Sat, 2 Aug 2003 17:31:43 -0700 (PDT) Received: from rwcrmhc12.comcast.net (rwcrmhc12.comcast.net [216.148.227.85]) by mx1.FreeBSD.org (Postfix) with ESMTP id 9C8A243F75 for ; Sat, 2 Aug 2003 17:31:40 -0700 (PDT) (envelope-from mwade@bluehighway.net) Received: from net-ninja.dyndns.org ([68.59.250.36]) by comcast.net (rwcrmhc12) with ESMTP id <2003080300312401400mp891e>; Sun, 3 Aug 2003 00:31:24 +0000 Received: from net-ninja.dyndns.org (net-ninja.dyndns.org [192.168.1.10]) by net-ninja.dyndns.org (Postfix) with ESMTP id 9D56E120 for ; Sat, 2 Aug 2003 20:31:23 -0400 (EDT) Date: Sat, 2 Aug 2003 20:31:23 -0400 (EDT) From: Mike Wade X-X-Sender: mwade@net-ninja.dyndns.org To: freebsd-net@freebsd.org Message-ID: <20030802203114.J4501@net-ninja.dyndns.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Subject: ipfw2 mac address matching weirdness? X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 03 Aug 2003 00:31:43 -0000 I'm running FreeBSD 4.8 RELEASE w/ IPFW2 support enabled. I'm running into some weirdness with the mac address matching feature or perhaps it's my lack of understanding how it interacts with other rules. :) My goal is to transparently redirect everything except a few select MAC addresses but it doesn't appear to work properly. For example: net-ninja# ipfw list 00001 skipto 65535 ip from any to any MAC any any in via sis0 00002 fwd 127.0.0.1,8080 tcp from any to any dst-port 80 in via sis0 65535 allow ip from any to any This should allow every MAC address to bypass the transparent redirect but it doesn't. If I change rule #1 to: 00001 skipto 65535 ip from any to any in via sis0 Things work as advertised. Any ideas? --- Mike Wade (mwade@bluehighway.net) Blue Highway Labs, LLC.