Re: Ipfw rules ?

From: Christian Hiris <4711_at_chello.at>
Date: Thu, 14 Oct 2004 05:32:22 +0200
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wednesday 13 October 2004 11:38, Putinas Piliponis wrote:
> Hello,
> I have a ipfw rule:
> add 40000 count ip from 10.127.0.2 to any MAC any 00:50:56:e4:79:6c in
> via lnc0
> But ipfw shows it like:
> 40000   0     0 count ip from 10.127.0.2 MAC any 00:50:56:e4:79:6c any
> in via lnc0
>
> Is ipfw really correctly showing the rule ?

AFAIK you need to split your rule into an "ip-rule" and a "MAC-rule". You need 
this, because the ip address-part only matches layer3 packets and the 
MAC-part only matches layer2 packets. At etherdemux/ether_output_frame ipfw 
doesn't know about the ip-address and at ip_input/ip_output ipfw doesn't know 
about the MAC-address. So your rule will never match.         

man 8 ipfw --> search for "packet flow"

Cheers,
ch

- -- 
Christian Hiris <4711_at_chello.at> | OpenPGP KeyID 0x3BCA53BE 
OpenPGP-Key at hkp://wwwkeys.eu.pgp.net and http://pgp.mit.edu
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (FreeBSD)

iD8DBQFBbfNq09WjGjvKU74RAoSDAJ9oQz4RgkKLZaVQowlLXVck0bnhsgCeIjXC
qG3gOOFhmW0wiKHE/GdFhEo=
=y0My
-----END PGP SIGNATURE-----
Received on Thu Oct 14 2004 - 01:33:02 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:38:17 UTC