ipfw divert with layer2 (if_bridge) packets

[Carlos E Gaspar]

Hi.
You're right, net.link.bridge.ipfw must be set to 1 to enable layer2 
filtering. Anyway, divert still doesn't work.

Thanks!
Carlos

Andrew Thompson wrote:

>On Tue, May 09, 2006 at 05:45:02PM -0300, Carlos E Gaspar wrote:
>  
>
>>Hi.
>>
>>I have the following setup:
>>
>>FreeBSD abc5.5-PRERELEASE FreeBSD 5.5-PRERELEASE #0: Wed Apr 26 14:58:22 
>>BRT 2006     root at abc:/usr/src/sys/alpha/compile/ABC alpha
>>
>>bridge0: flags=8043<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
>>       ether xx:xx:xx:xx:xx:xx
>>       priority 32768 hellotime 2 fwddelay 15 maxage 20
>>       member: de1 flags=3<LEARNING,DISCOVER>
>>       member: de0 flags=3<LEARNING,DISCOVER>
>>
>>de1 is my internal interface (local) and de0 the external (internet). 
>>host1 is on de1. Bridge works fine (if_bridge).
>>
>>With the following sysctl's:
>>
>>net.link.bridge.pfil_onlyip: 0
>>net.link.bridge.pfil_member: 1
>>net.link.bridge.pfil_bridge: 0
>>net.link.bridge.ipfw: 0
>>    
>>
>                  ^^^^^^^
>
>This should be 1. 
>
> net.link.bridge.ipfw   Set to 1 to enable layer2 filtering with
>                        ipfirewall(4), set to 0 to disable it.  This
>                        needs to be enabled for dummynet(4) support.
>                        When ipfw is enabled, pfil_bridge and
>                        pfil_member will be disabled so that IPFW is
>                        not run twice; these can be re-enabled if
>                        desired.
>
>
>Give that a try.
>
>cheers,
>Andrew
>_______________________________________________
>freebsd-net at freebsd.org mailing list
>http://lists.freebsd.org/mailman/listinfo/freebsd-net
>To unsubscribe, send any mail to "freebsd-net-unsubscribe at freebsd.org"
>  
>