Date: Thu, 21 Feb 2002 18:50:13 +0100 (CET) From: Simon J Mudd <sjmudd@pobox.com> To: freebsd-questions@freebsd.org Subject: Re: ipfw and getting the interface logged Message-ID: <Pine.LNX.4.44.0202211843150.850-100000@phoenix.ea4els.ampr.org> In-Reply-To: <20020221084955.C48401@blossom.cjclark.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Hello Crist,
On Thu, 21 Feb 2002, Crist J. Clark wrote:
> On Thu, Feb 21, 2002 at 05:18:59PM +0100, Simon J Mudd wrote:
> > I'm running 4.5-STABLE with ipfw and having trouble with my firewall
> > rules. However they are probably my own doing.
> >
> > Via syslog I see messages of the type:
> >
> > Feb 21 16:13:56 unicorn /kernel: Connection attempt to TCP 44.133.228.2:6000 from 44.133.228.5:2187
> > Feb 21 16:13:57 unicorn /kernel: Connection attempt to TCP 44.133.228.2:6000 from 44.133.228.5:2188
>
> Which are from net.inet.tcp.log_in_vain being set, not from ipfw(8).
>
> > Which I think my rules should allow:
> >
> > ${fwcmd} add pass all from ${inet} to ${inet} via ${iif}
>
> And they are letting it through if they are being logged in vain.
ipfw doesn't talk about this sysctl. Could you point me to something which
explains it better?
> > where
> >
> > # set these to your inside interface network and netmask and ip
> > iif="ed0"
> > inet="44.133.228.0/26"
> > iip="44.133.228.2"
> >
> > How can I get syslog to log more information such as at least the
> > interface over which the traffic is arriving?
>
> If ipfw(8) was logging the packets, the interface information would be
> there.
Ok, so for whatever reason my packets aren't being logged because my rules
don't matched correctly. I guess there's no way to get more information
out from the log_in_vain sysctl as it might help me diagnose my problem?
Thanks for this I guess I've got to go through looking at my current rules
and verifying what I'm doing wrong.
Simon
--
Simon J Mudd, Tel: +34-91-408 4878, Mobile: +34-605-085 219
Madrid, Spain. email: sjmudd@pobox.com, Postfix RPM Packager
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.LNX.4.44.0202211843150.850-100000>