IPFW rule sets and automatic rule numbering

[Willem Jan Withagen]

On 13-9-2014 21:51, Freddie Cash wrote:
> You can replicate it using 3 rules, loaded into two sets:
> 
> ipfw set disable 1
> ipfw add allow ip from any to any
> ipfw add 65524 allow ip from any to any
> ipfw add allow ip from any to any
> ipfw set swap 1 0
> 
> Run that two or 3 times. Every rule will be numbered 65534 after the 2nd or
> 3rd run.

> 
> I expected it to be numbered 10, 65524, 65534 after every run.
> 
> However, after reading the man page a few more times and thinking about it
> a little more, it makes sense that the numbering is global across all sets,
> as you can have multiple sets enabled simultaneously.
> 
> It just doesn't mesh with my desire to use auto numbering. I'm in the midst
> of manually numbering all my rules now. :)
> _______________________________________________
> freebsd-ipfw at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
> To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe at freebsd.org"
> 

This is easily circumvented by making shure that the first rule is

ipfw add 10 .....
like:
ipfw add count ip4 from any to any via vlan126
	(vlan126 is my outside connection)
And then you are home free.

I actually use this to also separate diffent types of block by injecting:
ipfw add <blocknumber> count ip from any to any

like:
03000 713812041 425643462848 count ip from any to any
03010         0            0 deny ip6 from fc00::/7 to any via vlan126

And the 3000 block contains all antispoofing and likes.

--WjW