Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 24 Sep 2009 15:03:43 -0700
From:      Chris St Denis <chris@smartt.com>
To:        "freebsd-questions@freebsd.org" <freebsd-questions@freebsd.org>
Subject:   ipfw: install_state: entry already present, done
Message-ID:  <4ABBECBF.8050505@smartt.com>

Next in thread | Raw E-Mail | Index | Archive | Help
I'm trying to setup a stateful firewall for my server such that any 
traffic can go out, and it's reply come back. However I'm getting the 
error message "ipfw: install_state: entry already present, done" 
repeated many times in my logs (tho the rules seemed to work fine 
otherwise).

I stripped down the rules to the minimum I could and discovered the line 
causing it is "allow udp from me to any keep-state". The similar line 
for TCP also causes it too if the "setup" keyword is left off. But UDP 
does not work if I put the setup keyword on it's line (because there is 
no setup for UDP I assume)

Full firewall rules:

    dns2# ipfw list
    00100 allow ip from any to any via lo0
    00200 deny ip from any to 127.0.0.0/8
    00300 deny ip from 127.0.0.0/8 to any
    00400 allow udp from me to any keep-state
    65535 deny ip from any to any

I found some search results for this error message, but none seem to 
have a solution to the problem.

System info:
dns2# uname -a
FreeBSD dns2 7.2-RELEASE-p2 FreeBSD 7.2-RELEASE-p2 #0: Wed Jun 24 
00:14:35 UTC 2009     
root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC  amd64

Hardware: virtual server under vmWare ESXi (not that that should matter)

network card: em0


-- 
Chris St Denis
Programmer
SmarttNet (www.smartt.com)
Ph: 604-473-9700 Ext. 200
-------------------------------------------
"Smart Internet Solutions For Businesses" 




Want to link to this message? Use this URL: <http://docs.FreeBSD.org/cgi/mid.cgi?4ABBECBF.8050505>