Re: [FreeBSD 5.2] Bandwith and packet throttling

From: Fargo Holiday (galaxy.ranger_at_gmail.com)
Date: 08/15/04

  • Next message: Pawel Malachowski: "Re: ipfilter/ipnat 3.4.35 and udp-traceroute problem" 
    Date: Sun, 15 Aug 2004 13:57:30 -0700
To: freebsd-net@freebsd.org

    Thank you greatly everyone, derision aside, and especially Pawel.
    The deny loopback is strange, I assume my roommate put that in there
    or it is a strange default rule.

    And, to be honest, when I looked at the man page, I didn't see any
    indication that a successful rule match halted the pattern search, and
    in fact the last firewall/routing solution I used was some ***
    piece of software running a Solaris machine. I don't recall the name
    of it, but let's just say the experience doesn't carry over to this
    layout. Here is what I saw in the man page, and why it didn't occur to
    me that the rule placement was important:

    "An ipfw configuration, or ruleset, is made of a list of rules numbered
         from 1 to 65535. Packets are passed to ipfw from a number of different
         places in the protocol stack (depending on the source and destination of
         the packet, it is possible that ipfw is invoked multiple times on the
         same packet). The packet passed to the firewall is compared against each
         of the rules in the firewall ruleset. When a match is found, the action
         corresponding to the matching rule is performed."

    and a little later:

    " Also note that each packet is always checked against the complete rule-
         set, irrespective of the place where the check occurs, or the source of
         the packet."

    Though I did initially overlook this part:

    "Depending on the action and certain system settings, packets can be rein-
         jected into the firewall at some rule after the matching one for further
         processing."

    Which vaguely implys such a thing, I never came across a section that
    mentioned this behavior of exiting after a match.

    Anyway, thanks again y'all, I truly appreciate it.
    _______________________________________________
    freebsd-net@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-net
    To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"

  • Next message: Pawel Malachowski: "Re: ipfilter/ipnat 3.4.35 and udp-traceroute problem"