Date: Sun, 28 Nov 2004 14:27:41 +0200 From: Giorgos Keramidas <keramida@ceid.upatras.gr> To: Jonathon McKitrick <jcm@FreeBSD-uk.eu.org> Cc: freebsd-questions@freebsd.org Subject: Re: Is this a hole in my firewall? Message-ID: <20041128122741.GB43088@gothmog.gr> In-Reply-To: <20041128044847.GA1435@dogma.freebsd-uk.eu.org> References: <20041127215612.GA86416@dogma.freebsd-uk.eu.org> <20041128013135.GD662@gothmog.gr> <20041128044847.GA1435@dogma.freebsd-uk.eu.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On 2004-11-28 04:48, Jonathon McKitrick <jcm@FreeBSD-uk.eu.org> wrote: > On Sun, Nov 28, 2004 at 03:31:35AM +0200, Giorgos Keramidas wrote: > : AFAIK, rule 00300 will never be hit by packets going out tun0 as long as > : you also have rule 00200 in there. > > Hmmm.... here's a run after having the laptop running for a bit. I don't > see why 200 doesn't cover the case either. > > root@neptune:~# ipfw show > 00100 0 0 check-state > 00200 6709 1277079 allow ip from me to any keep-state out xmit tun0 > 00300 2093 645797 allow ip from any to any keep-state out xmit tun0 Oops! That doesn't look good, unless I'm missing something about the way 'me' works. It's probably a good idea to send what you have so far to the freebsd-ipfw people.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20041128122741.GB43088>