Date: Thu, 13 May 2004 12:35:42 +0400 From: Gleb Smirnoff <glebius@cell.sick.ru> To: Eugene Grosbein <eugen@kuzbass.ru> Cc: net@freebsd.org Subject: Re: ipfw: reset tcp Message-ID: <20040513083542.GD31159@cell.sick.ru> In-Reply-To: <40A34082.F0182B31@kuzbass.ru> References: <40A3393F.1391943E@kuzbass.ru> <20040513012344.A12373@xorpc.icir.org> <40A34082.F0182B31@kuzbass.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, May 13, 2004 at 05:31:46PM +0800, Eugene Grosbein wrote: E> > > When a rule 'reset tcp' matches, a kernel generates new TCP packet. E> > > Will it have to go through ipfw list (from the beginning or not)? E> > E> > ipfw2 uses an mbuf flag to bypass the firewall - I am not sure if i E> > only used it for the keepalives or also for TCP reset packets E> E> Please check. I suspect it does not enter ipfw itself, E> it is not processed by my natd and bad things happen here. According to send_pkt() in ip_fw2.c it does not pass firewall, since M_SKIP_FIREWALL is set. -- Totus tuus, Glebius. GLEBIUS-RIPN GLEB-RIPE
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040513083542.GD31159>