Date: Sun, 24 Jul 2005 20:33:53 +0200 From: Dirk GOUDERS <gouders@et.bocholt.fh-ge.de> To: questions@freebsd.org Subject: Re: ipfw and tun0 Message-ID: <200507241833.j6OIXrd2000676@karga.hank.home> In-Reply-To: Message from Chuck Swiger <cswiger@mac.com> of "Sun, 24 Jul 2005 12:09:01 EDT." <42E3BD1D.4020301@mac.com>
next in thread | previous in thread | raw e-mail | index | archive | help
> > Well, I am a little bit confused, because usually, I run machines with > > "real" NICs and if I activate firewall rules that drop packets from > > that NIC, I can run tcpdump on that NIC and will not see the dropped > > packets. > > Are you 100% certain of that? No, I now realize, that I was always inspecting ipfw's log messages and just assumed that dropped packets do not appear to tcpdump without ever verifying that assumption. Thanks for pointing that out. > > Does that mean, that there is no way, to inspect the network > > traffic from tun0 after it has been "cleaned up" by ipfw and that is > > not forwarded to the internal NIC? > > You can either add a log rule after your IPFW reject rules, and have the > firewall itself log the traffic which is permitted through, or you could use > another divert rule and force that traffic into a daemon which looks at the > packets (this is how natd works, after all). I guess, I will use ipfw's logging facility. Thanks again for clarification. Dirk
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200507241833.j6OIXrd2000676>