From owner-freebsd-ipfw  Wed Jul 10  7: 9:12 2002
Delivered-To: freebsd-ipfw@freebsd.org
Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 186D437B405
	for <ipfw@freebsd.org>; Wed, 10 Jul 2002 07:09:10 -0700 (PDT)
Received: from gs166.sp.cs.cmu.edu (GS166.SP.CS.CMU.EDU [128.2.205.169])
	by mx1.FreeBSD.org (Postfix) with SMTP id 1962243E4A
	for <ipfw@freebsd.org>; Wed, 10 Jul 2002 07:09:09 -0700 (PDT)
	(envelope-from dpelleg@gs166.sp.cs.cmu.edu)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <15660.16374.50102.170751@gs166.sp.cs.cmu.edu>
Date: Wed, 10 Jul 2002 10:08:54 -0400
To: Luigi Rizzo <rizzo@icir.org>
Cc: ipfw@freebsd.org
Subject: Re: ipfw2 patches for -stable available
In-Reply-To: <20020710062146.A93900@iguana.icir.org>
References: <20020709023203.A83270@iguana.icir.org>
	<u2sy9ckpbo1.fsf@gs166.sp.cs.cmu.edu>
	<20020709221347.A91104@iguana.icir.org>
	<15660.2959.142937.827544@gargle.gargle.HOWL>
	<20020710062146.A93900@iguana.icir.org>
X-Mailer: VM 6.90 under 21.1 (patch 14) "Cuyahoga Valley" XEmacs Lucid
From: Dan Pelleg <daniel+bsd@pelleg.org>
Reply-To: Dan Pelleg <daniel+bsd@pelleg.org>
Sender: owner-freebsd-ipfw@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-ipfw.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-ipfw>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-ipfw>
X-Loop: FreeBSD.ORG


Luigi Rizzo writes:
 > On Wed, Jul 10, 2002 at 06:25:19AM -0400, Dan Pelleg wrote:
 > ...
 > > That's easy:
 > > 
 > > sh /etc/rc.firewall closed
 > > 
 > > ipfw add 500 pass tcp from me to any keep-state limit src-addr dst-port 40
 > 
 > ah, that is a bug in your ruleset:
 > "keep-state" and "limit" are incompatible, if you use one you should
 > not use the latter. For the old code the overloading of several fields
 > in the rule descriper masked the bug.
 > 

 Huh. I always thought of limit as "a keep-state rule with some additional
restrictions".

 > I will add some checks in /sbin/ipfw to flag this incorrect usage.
 > 
 > In the meantime could you check if removing "keep-state" from
 > the limit rules still causes the problem ?
 > 

Removing keep-state seems to solve the problem. Thanks!

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ipfw" in the body of the message