Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 24 Sep 2009 15:03:43 -0700
From:      Chris St Denis <>
To:        "" <>
Subject:   ipfw: install_state: entry already present, done
Message-ID:  <>

Next in thread | Raw E-Mail | Index | Archive | Help
I'm trying to setup a stateful firewall for my server such that any 
traffic can go out, and it's reply come back. However I'm getting the 
error message "ipfw: install_state: entry already present, done" 
repeated many times in my logs (tho the rules seemed to work fine 

I stripped down the rules to the minimum I could and discovered the line 
causing it is "allow udp from me to any keep-state". The similar line 
for TCP also causes it too if the "setup" keyword is left off. But UDP 
does not work if I put the setup keyword on it's line (because there is 
no setup for UDP I assume)

Full firewall rules:

    dns2# ipfw list
    00100 allow ip from any to any via lo0
    00200 deny ip from any to
    00300 deny ip from to any
    00400 allow udp from me to any keep-state
    65535 deny ip from any to any

I found some search results for this error message, but none seem to 
have a solution to the problem.

System info:
dns2# uname -a
FreeBSD dns2 7.2-RELEASE-p2 FreeBSD 7.2-RELEASE-p2 #0: Wed Jun 24 
00:14:35 UTC 2009  amd64

Hardware: virtual server under vmWare ESXi (not that that should matter)

network card: em0

Chris St Denis
SmarttNet (
Ph: 604-473-9700 Ext. 200
"Smart Internet Solutions For Businesses" 

Want to link to this message? Use this URL: <>