Date: Mon, 13 Sep 2010 11:32:03 +0700 From: Victor Sudakov <sudakov@sibptus.tomsk.ru> To: freebsd-questions@freebsd.org Subject: Re: ipfw fwd and ipfw allow Message-ID: <20100913043203.GB11527@admin.sibptus.tomsk.ru> In-Reply-To: <4c8b3849.mx6rDwHZtDT6N5YR%perryh@pluto.rain.com> References: <20100822052550.GA42346@admin.sibptus.tomsk.ru> <20100907090012.GA48608@admin.sibptus.tomsk.ru> <4C8616F0.5010401@gmx.com> <20100907110033.GA51618@admin.sibptus.tomsk.ru> <4C864145.80805@gmx.com> <20100907145223.GA55660@admin.sibptus.tomsk.ru> <4C8754CD.6030003@gmx.com> <20100910125534.GA50527@admin.sibptus.tomsk.ru> <4c8b3849.mx6rDwHZtDT6N5YR%perryh@pluto.rain.com>
next in thread | previous in thread | raw e-mail | index | archive | help
perryh@pluto.rain.com wrote: > > > ... the 'fwd ... keep-state' statement does create a useful > > dynamic rule. It contradicts the ipfw(8) man page but works ... > > Hopefully someone who understands all this will submit a patch > for the man page :) The man page says that the "Dynamic rules will be checked at the first check-state, keep-state or limit occurrence, and the action performed upon a match will be the same as in the parent rule." It suggests that if the parent rule is a 'fwd' rule, the corresponding dynamic rule is also a 'fwd' rule, which would be no use (who needs a reflexive 'fwd' rule?). However, in reality a parent 'fwd' rule seems to create an 'allow' dynamic rule, which is useful but confusing. Where exactly is this place in the ipfw code? -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN sip:sudakov@sibptus.tomsk.ru
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20100913043203.GB11527>