Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 05 Nov 2007 12:48:40 +1300
From:      Russell Fulton <r.fulton@auckland.ac.nz>
To:        john.w.court@nokia.com
Cc:        freebsd-ipfw@freebsd.org, gbell72@rogers.com
Subject:   Re: IPFW Problem
Message-ID:  <472E5A58.5090707@auckland.ac.nz>
In-Reply-To: <DBA4167E9E1EB44D8476A6F928BE52452B5379@siebe101.NOE.Nokia.com>
References:  <932971.53959.qm@web88014.mail.re2.yahoo.com> <DBA4167E9E1EB44D8476A6F928BE52452B5379@siebe101.NOE.Nokia.com>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help


john.w.court@nokia.com wrote:
> Hmm, I may well be missing something very obvious but rule 01000 seems
> to be doing exactly what it says it will.  Are you sure you meant "deny"
> rather than "allow" on rule 01000 ?

Note that it is immediately after the check state rule.  What the
Gardner intended was to drop established tcp traffic that was not part
of a session for which there was already state.  In fact this rule is
redundant since (assuming I've read the rule set correctly) such traffic
will get caught by the final deny rule.

What is odd about this problem is that it appears to be a timeout
problem and thus probably not related to the firewall at all.  To me it
seems that the initial SYN packet is getting lost and the retry gets
through, hence the delay.

I suggested to Gardner that he log all dropped packets so he can see if
it really is the firewall which is causing the problem.

Russell



Want to link to this message? Use this URL: <http://docs.FreeBSD.org/cgi/mid.cgi?472E5A58.5090707>