Date: Sat, 10 Jul 2004 04:47:02 -0600 From: Buuyo <buuyou@gmail.com> To: freebsd-questions@freebsd.org Subject: ipfw and matching bridged packets with both 'xmit' and 'recv' Message-ID: <7d2ccc0e04071003477ac8ab9f@mail.gmail.com>
next in thread | raw e-mail | index | archive | help
Hello. I have a functioning bridge set up between rl0 and rl2 on a machine running FreeBSD 4.9, and I'd like to count tcp connections initiated from the clients on the rl2 side to hosts on the rl0 side, but not from the machine functioning as a bridge. I set the sysctl values net.link.ether.ipfw and net.link.ether.bridge_ipfw to 1, and I invisioned this ipfw command: ipfw add 1 count tcp from any to any out recv rl2 xmit rl0 bridged setup and, as expected, ended up with this: root@bwca$ ipfw show 00001 0 0 count tcp from any to any out recv rl2 xmit rl0 layer2 setup 60000 130074716 89026633533 allow ip from any to any 65535 252 21461 deny ip from any to any >From a client on the rl2 side of the bridge, I established a tcp connection to a host on the rl0 side, but an ipfw show 1 revealed that the counter hadn't been incremented. What am I missing? I understand, based on my interpretation of the "recv | xmit | via {ifX | if* | ipno | any}" section of the ipfw manual page that you can have recv and xmit both in the same rule provided that it's outbound. What can I do to get my desired functionality? Thanks. I'm sorry, but I'm not subscribed to the freebsd-questions list. Could you please send a carbon copy of your message to this email address?
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?7d2ccc0e04071003477ac8ab9f>