Date: Sun, 19 Jun 2005 13:01:43 +0200 From: Robert Usle <robertusn@gmail.com> To: freebsd-pf@freebsd.org Subject: ipfw -pf processing order Message-ID: <3713853f05061904017a4a7e3f@mail.gmail.com>
next in thread | raw e-mail | index | archive | help
Hi, I'm using FreeBSD 5.4 with ipfw (module) & pf (kernel compiled) firewall. pf is used for nat, pass/block, rdr, and dummynet/ipfw is used only for packet queueing. ext_if =3D vr0 int_if =3D rl1 ipfw rules: /sbin/ipfw pipe 10 config bw 256Kbit/s queue 20 mask dst-ip 0x000000ff /sbin/ipfw pipe 11 config bw 256Kbit/s queue 20 mask src-ip 0x000000ff /sbin/ipfw add 100 pipe 10 log ip from any to 10.0.9.0/24=20 /sbin/ipfw add 101 pipe 11 log ip from 10.0.9.0/24 to any=20 sysctl: net.inet.ip.fw.one_pass: 1 (I've also tried with 'via','xmit','recv' tags) I see packets coming to my dummynet pipes/rules, but then=20 pf rdr rule: rdr on $int_if proto tcp from $internal_net to any port 80 -> 127.0.0.1 port 3128 does not work. When i disable ipfw firewall, it's just ok again. pf options are as follows: set optimization normal set block-policy drop set require-order yes scrub in all Is this related to firewall processing order ? Thanks, --=20 Robert
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3713853f05061904017a4a7e3f>