From owner-freebsd-ipfw@FreeBSD.ORG  Thu May  3 12:11:51 2007
Return-Path: <owner-freebsd-ipfw@FreeBSD.ORG>
X-Original-To: freebsd-ipfw@freebsd.org
Delivered-To: freebsd-ipfw@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 8D01716A401
	for <freebsd-ipfw@freebsd.org>; Thu,  3 May 2007 12:11:51 +0000 (UTC)
	(envelope-from bounces@nabble.com)
Received: from talk.nabble.com (www.nabble.com [72.21.53.35])
	by mx1.freebsd.org (Postfix) with ESMTP id 74C1713C43E
	for <freebsd-ipfw@freebsd.org>; Thu,  3 May 2007 12:11:51 +0000 (UTC)
	(envelope-from bounces@nabble.com)
Received: from [72.21.53.38] (helo=jubjub.nabble.com)
	by talk.nabble.com with esmtp (Exim 4.50) id 1HjaA3-0000fP-6Q
	for freebsd-ipfw@freebsd.org; Thu, 03 May 2007 05:11:51 -0700
Message-ID: <10303574.post@talk.nabble.com>
Date: Thu, 3 May 2007 05:11:51 -0700 (PDT)
From: Nicolargo <hennion@alcasat.net>
To: freebsd-ipfw@freebsd.org
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Nabble-From: hennion@alcasat.net
Subject: IPFW + Bridge + Routing
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 03 May 2007 12:11:51 -0000


Hi all,

here is y configuration:

        PC3
         |
         |
       FW
      /    \
     /      \
PC1       PC2

FW: FreeBSD 6.2
Interface PC1 and PC2: bridged (172.18.0.254)
Interface PC3: Routed (172.16.1.2)
PC1: 172.18.0.1
PC2: 172.18.0.2
PC3: 172.16.1.1 

Ipfw:
ipfw add 1 allow ip from any to any MAC any any
ipfw add 2 allow ip from any to any

Bridge:
net.link.ether.bridge_cfg: 
net.link.ether.bridge_ipfw: 0
net.link.ether.bridge_ipf: 0
net.link.ether.bridge.config: 
net.link.ether.bridge.enable: 1
net.link.ether.bridge.predict: 1250
net.link.ether.bridge.dropped: 0
net.link.ether.bridge.packets: 1294
net.link.ether.bridge.ipfw_collisions: 0
net.link.ether.bridge.ipfw_drop: 0
net.link.ether.bridge.copy: 0
net.link.ether.bridge.ipfw: 0
net.link.ether.bridge.ipf: 0
net.link.ether.bridge.debug: 0
net.link.ether.bridge.version: 031224
net.link.bridge.ipfw: 1
net.link.bridge.pfil_member: 1
net.link.bridge.pfil_bridge: 1
net.link.bridge.ipfw_arp: 0
net.link.bridge.pfil_onlyip: 1

rc.conf:
cloned_interfaces="bridge0"
ifconfig_bridge0="addm bge0 addm em0 up"
ifconfig_bge0="inet 172.18.0.254 netmask 255.255.255.0"
ifconfig_em0="up"
ifconfig_em2="inet 172.16.1.2 netmask 255.255.255.0"
firewall_enable="YES"
firewall_script="/etc/ipfw.rules"

The problem is the following:
PING PC1 -> PC2 : OK
PING PC2 -> PC1: OK
PING FW -> ANY: OK
PING PC1 -> PC3: NOK
PING PC2 -> PC3: NOK
PING PC3 -> ANY: NOK

During a PING between PC1 and PC3, a tcpdump on the em2 interface shows:
14:10:43.564010 IP 172.18.0.1 > 172.16.1.1: ICMP echo request, id 34831, seq
7993, length 64
14:10:43.564687 IP 172.16.1.1 > 172.18.0.1: ICMP echo reply, id 34831, seq
7993, length 64

but the reply packet is lost in the firewall and never redirected to the
bridge0 interface...

Any idea ?

Nicolas

-- 
View this message in context: http://www.nabble.com/IPFW-%2B-Bridge-%2B-Routing-tf3686063.html#a10303574
Sent from the freebsd-ipfw mailing list archive at Nabble.com.