From owner-freebsd-questions Thu Sep 20 14:10:53 2001 Delivered-To: freebsd-questions@freebsd.org Received: from albatross.prod.itd.earthlink.net (albatross.mail.pas.earthlink.net [207.217.120.120]) by hub.freebsd.org (Postfix) with ESMTP id 2C0C537B408 for ; Thu, 20 Sep 2001 14:10:49 -0700 (PDT) Received: from blossom.cjclark.org (dialup-209.245.131.52.Dial1.SanJose1.Level3.net [209.245.131.52]) by albatross.prod.itd.earthlink.net (EL-8_9_3_3/8.9.3) with ESMTP id OAA26496; Thu, 20 Sep 2001 14:10:42 -0700 (PDT) Received: (from cjc@localhost) by blossom.cjclark.org (8.11.4/8.11.3) id f8KLAav01788; Thu, 20 Sep 2001 14:10:36 -0700 (PDT) (envelope-from cjc) Date: Thu, 20 Sep 2001 14:10:36 -0700 From: "Crist J. Clark" To: rick norman Cc: Paul Herman , freebsd-questions@FreeBSD.ORG Subject: Re: ipfw Message-ID: <20010920141036.H309@blossom.cjclark.org> Reply-To: cjclark@alum.mit.edu References: <20010920130530.W9645-100000@tick.sc.omation.com> <3BAA573C.3B180146@lmco.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <3BAA573C.3B180146@lmco.com>; from rick.norman@lmco.com on Thu, Sep 20, 2001 at 01:53:16PM -0700 Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Thu, Sep 20, 2001 at 01:53:16PM -0700, rick norman wrote: > No, it seems to have no effect. > > Paul Herman wrote: > > > On Tue, 18 Sep 2001, rick norman wrote: > > > > > I am attempting to use ipfw and dummynet to instrument some network > > > traffic tests. I am running freebsd 4.3 release and have built the > > > kernel > > > with ipfirewall, dummynet, and default to enabled. For a simple test, I > > > > > > added a pipe "ipfw add pipe 1 icmp from any to any". When I ping this > > > machine, I can do "ipfw pipe 1 show" and watch the counters increment, > > > but the machine doing the pinging does not see a response to the ping. > > > > Does "sysctl net.inet.ip.fw.one_pass=0" help? Actually, I think Paul may have meant, # sysctl -w net.inet.ip.fw.one_pass=1 Or else you need a rule after the 'pipe' rule to actually pass the ICMP. When you do a, # ipfw show While pinging, are other rules incrementing? Where do these ICMP packets end up going in the firewall rules? -- Crist J. Clark cjclark@alum.mit.edu To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message