From owner-freebsd-current@FreeBSD.ORG Thu Oct 14 03:33:02 2004 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id BEB4D16A4CE for ; Thu, 14 Oct 2004 03:33:02 +0000 (GMT) Received: from chello084114137224.1.15.vie.surfer.at (chello084114137224.1.15.vie.surfer.at [84.114.137.224]) by mx1.FreeBSD.org (Postfix) with SMTP id 4D7C343D55 for ; Thu, 14 Oct 2004 03:33:01 +0000 (GMT) (envelope-from 4711@chello.at) Received: (qmail 17455 invoked from network); 14 Oct 2004 03:32:59 -0000 Received: from matrix010.matrix.net (192.168.123.10) by ns.matrix.net with SMTP; 14 Oct 2004 03:32:59 -0000 From: Christian Hiris <4711@chello.at> To: freebsd-current@freebsd.org Date: Thu, 14 Oct 2004 05:32:22 +0200 User-Agent: KMail/1.7 References: <217202CB5FF8AE439E263CE3D48ECB50757DC3@honda.int.hansa.lt> In-Reply-To: <217202CB5FF8AE439E263CE3D48ECB50757DC3@honda.int.hansa.lt> Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200410140532.58548.4711@chello.at> Subject: Re: Ipfw rules ? X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Oct 2004 03:33:02 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wednesday 13 October 2004 11:38, Putinas Piliponis wrote: > Hello, > I have a ipfw rule: > add 40000 count ip from 10.127.0.2 to any MAC any 00:50:56:e4:79:6c in > via lnc0 > But ipfw shows it like: > 40000 0 0 count ip from 10.127.0.2 MAC any 00:50:56:e4:79:6c any > in via lnc0 > > Is ipfw really correctly showing the rule ? AFAIK you need to split your rule into an "ip-rule" and a "MAC-rule". You need this, because the ip address-part only matches layer3 packets and the MAC-part only matches layer2 packets. At etherdemux/ether_output_frame ipfw doesn't know about the ip-address and at ip_input/ip_output ipfw doesn't know about the MAC-address. So your rule will never match. man 8 ipfw --> search for "packet flow" Cheers, ch - -- Christian Hiris <4711@chello.at> | OpenPGP KeyID 0x3BCA53BE OpenPGP-Key at hkp://wwwkeys.eu.pgp.net and http://pgp.mit.edu -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (FreeBSD) iD8DBQFBbfNq09WjGjvKU74RAoSDAJ9oQz4RgkKLZaVQowlLXVck0bnhsgCeIjXC qG3gOOFhmW0wiKHE/GdFhEo= =y0My -----END PGP SIGNATURE-----