Date: Thu, 5 Jul 2018 08:39:09 +0200 From: Andrea Venturoli <ml@netfence.it> To: "Andrey V. Elsukov" <bu7cher@yandex.ru>, freebsd-net@freebsd.org, wishmaster <artemrts@ukr.net> Subject: Re: Questions about ipfw's dynamic rules' dyn_keepalive Message-ID: <c5311a62-a9dd-e010-b70c-061b15d99b0d@netfence.it> In-Reply-To: <25e56a77-8374-d273-0b5e-2f11c1b03ff8@yandex.ru> References: <04ad23ad-4020-7c07-8d75-eef6e84f4de8@netfence.it> <756b78e2-4e65-ab03-1e91-943a77fdf45d@yandex.ru> <25e56a77-8374-d273-0b5e-2f11c1b03ff8@yandex.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
On 04/03/18 12:54, Andrey V. Elsukov wrote: > On 03.04.2018 13:45, Andrey V. Elsukov wrote: >>> Can anybody give any hint about the above behaviours or point me to good >>> documentation? The man pages is very brief on this, unfortunately. >> >> Hi, >> >> ipfw uses M_SKIP_FIREWALL flag for self-generated packets. Thus >> keep-alive packets are sent bypass the rules. When you use NAT, I guess >> keep-alive packets have private source address, because they are not go >> through the NAT rule. And because of this remote host drops them without >> reply. Since there are no replies to keep-alive requests, a state times >> out. > > You can try this patch: > > https://people.freebsd.org/~ae/ipfw_bypass_own_packets11.diff > > It adds sysctl variable net.inet.ip.fw.bypass_own_packets, that can > control the behavior of M_SKIP_FIREWALL flag. > Hello. Now that this patch applies cleanly to 11.2, I tried it. After setting net.inet.ip.fw.bypass_own_packets to 0, I run the same tests again: unfortunately nothing seems to have changed... I only see keep-alive packets when there's no NAT or FWD rule involved. Is anything more required besides patching, recompiling the kernel and tuning the sysctl? Perhaps this setting must be done on boot and cannot be enabled later or something like that? For wishmaster: Since you said it works for you, can I ask which FreeBSD version you tested this on? Do you have any other patch or specific setup? How did you test this? Thanks a lot to anyone Andrea Venturoli
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?c5311a62-a9dd-e010-b70c-061b15d99b0d>