Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 10 Jul 2002 06:21:47 -0700
From:      Luigi Rizzo <>
To:        Dan Pelleg <>
Subject:   Re: ipfw2 patches for -stable available
Message-ID:  <>
In-Reply-To: <15660.2959.142937.827544@gargle.gargle.HOWL>; from on Wed, Jul 10, 2002 at 06:25:19AM -0400
References:  <> <> <> <15660.2959.142937.827544@gargle.gargle.HOWL>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
On Wed, Jul 10, 2002 at 06:25:19AM -0400, Dan Pelleg wrote:
> That's easy:
> sh /etc/rc.firewall closed
> ipfw add 500 pass tcp from me to any keep-state limit src-addr dst-port 40

ah, that is a bug in your ruleset:
"keep-state" and "limit" are incompatible, if you use one you should
not use the latter. For the old code the overloading of several fields
in the rule descriper masked the bug.

I will add some checks in /sbin/ipfw to flag this incorrect usage.

In the meantime could you check if removing "keep-state" from
the limit rules still causes the problem ?

> I have another bug to report. The following causes a segfault on a
> DUMMYNET-less machine:
> ipfw queue 1 config pipe 10 weight 100 mask src-ip 0xffffffff

will look into this.

	thanks again

To Unsubscribe: send mail to
with "unsubscribe freebsd-ipfw" in the body of the message

Want to link to this message? Use this URL: <>