Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 5 Jan 2015 14:41:47 +0100
From:      =?ISO-8859-1?Q?Olivier_Cochard=2DLabb=E9?= <olivier@cochard.me>
To:        Willy@offermans.rompen.nl
Cc:        "freebsd-ipfw@freebsd.org" <freebsd-ipfw@freebsd.org>, Luigi Rizzo <rizzo@iet.unipi.it>
Subject:   Re: Why ipfw didn't filter neither log DHCP packets ?
Message-ID:  <CA+q+TcoX7_0++G8b77T-CXGDzmNZhww8hGXVsJxL0C0Qf5cQ7Q@mail.gmail.com>
In-Reply-To: <20150105122809.GD31058@vpn.offrom.nl>
References:  <CA+q+TcpOuWXFHO73a5YuSws4ade-9r5e0=J_SY=DCxh1r9pe=Q@mail.gmail.com> <CA+hQ2+gt0JzbQo-2TWtzf_DS-di6csbuGn=GoOaoStuQJdT8sg@mail.gmail.com> <20150105122809.GD31058@vpn.offrom.nl>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
On Mon, Jan 5, 2015 at 1:28 PM, Willy Offermans <Willy@offermans.rompen.nl>
wrote:

> Hello Luigi and FreeBSD friends,
>
> I do top posting.
>
> So there might be a chance that someting slips through the firewall
> between the start of the firewall and after the bpf traffic of dhclient.
> Once the NIC is configured, traffic is possible in principle.
> Would it be better to start the bpf traffic of dhclient after the firewall
> runs. In the latter case, all will or can work as expected. If yes, how
> should this be set? Should one set
>
>  REQUIRE: firewall
>
> in /etc/rc.d/dhclient? But there seems no firewall daemon to be present. So
> I'm not sure how this should work.
>
>
I believe that when Luigi says "that acts before the firewall has a chance
to see the packets", he was not speaking of the RC script order, but about
the FreeBSD network stack layer order.
Do you confirm Luigi ?

Because I've tryed to fix ifpw's RC script order by changing:
- /etc/rc.d/ipfw: replaced "REQUIRE: ppp" by "REQUIRE: FILESYSTEMS" (like
/etc/rc.d/ipfilter)
- /etc/rc.d/netif: Add "ipfw" in the REQUIRE list

But no change: DHCP is still allowed.

Then, why there are specific DHCP-clients rules in /etc/rc.firewall script
(like in WORKSTATION mode) if there are useless ?



Want to link to this message? Use this URL: <http://docs.FreeBSD.org/cgi/mid.cgi?CA+q+TcoX7_0++G8b77T-CXGDzmNZhww8hGXVsJxL0C0Qf5cQ7Q>