ipfw pipes + firewall

[Khairil Yusof]

I've read the man pages, and tested it out, and just want to confirm
that what I"m doing is right and that I didn't miss anything.

Disable one_pass so that packets after matching pipe rule will continue
on to other rules. Without this, packets matching pipes are not not
applied again against firewall rules.

net.inet.ip.fw.one_pass: 0

I then put the pipe rules before any firewall rules so that anything
going in and out (in this case) go through the pipes first. They are
then matched by normal firewall rules.

00100  83 11350 pipe 1 ip from any to any out
00200  93 11266 pipe 2 ip from any to any in
00300   0     0 check-state
00400   0     0 deny tcp from any to any established
01400 103 14855 allow tcp from any to me dst-port 22 in setup keep-state
... more firewall rules which are being matched

From what I can see the pipe rules are being matched. I tested bandwidth
controls, and they work. And I also could not access ports which I did
have a dynamic rule for (as in 01400).

--


FreeBSD 5.2-BETA i386 
4:56pm up 20:23, 4 users, load averages: 0.99, 0.76, 0.66
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20031128/6913d2fd/attachment.bin