Re: One OR MORE of source and destination addresses?

From: Mark (admin_at_asarian-host.net)
Date: 08/02/04

  • Next message: Mark: "Re: One OR MORE of source and destination addresses?" 
    Date: Mon, 02 Aug 2004 16:02:53 GMT
To: <freebsd-questions@freebsd.org>

    Mark wrote:

    > Color me confused. The ipfw manual says:
    >
    > limit {src-addr | src-port | dst-addr | dst-port} N
    > The firewall will only allow N connections with the same set of
    > parameters as specified in the rule. One or more of source and
    > destination addresses and ports can be specified.
    >
    > If "One or more of source and destination addresses and ports can be
    > specified", then I'd like to limit both the total amount of
    > connections, as well as per-src. Something like this:
    >
    > ipfw check-state ipfw add allow tcp from any to me 25 setup limit dst-addr
    > 32 src-addr 8
    >
    > The error I get is:
    >
    > "ipfw: only one of keep-state and limit is allowed"
    >
    > So, how can I specify "One OR MORE of source and destination
    > addresses" in the rule to achieve this effect?

    Thanks for your reply.

    JJB wrote:

    > Like the manual says, you can not code both options on single rule. You
    > have to make 2 rules out of it.
    >
    > state ipfw add allow tcp from any to me 25 setup limit dst-addr 32
    > state ipfw add allow tcp from any to me 25 setup limit src-addr 8

    Actually, that is what I had already done:

    ipfw add 10 check-state ipfw add 11 allow tcp from any to me 25 setup limit
    dst-addr 32 ipfw add 12 check-state ipfw add 13 allow tcp from any to me 25
    setup limit src-addr 4

    But it seems I never get to rule 12/13. All "ipfw show" shows, is activity
    on rule 10/11. That is why I figured I made an error somewhere. Does not
    rule 11, indeed, function as an 'early-out'? (undesired).

    Thanks,

    - Mark

    _______________________________________________
    freebsd-questions@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-questions
    To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"

  • Next message: Mark: "Re: One OR MORE of source and destination addresses?"

    Relevant Pages

    • Re: TO CATCH A PREDATOR IN TALK.ORIGINS -- JFK, 911 and Other Conspiracies
      ... Some blokes establish, specify, and breed. ... mark. ... Many grateful huntings near the unwilling hemisphere were ...
      (sci.crypt)
    • RE: Uptating from a local view
      ... Mark there was a typing mistake in my code. ... > You did not specify a KeyField and there are some typos e.g ... >> unload method gets executed and it gives me the following error message. ... >> OPEN DATABASE data1 ...
      (microsoft.public.fox.programmer.exchange)
    • Re: Shoot the @#%$ Server - Part 2
      ... Common sense told me to specify the actual file but ... Mark ... > http://SomeServer/SqlXmlVDir/SoapVname?wsdl to get the WSDL file. ... > Irwin Dolobowsky ...
      (microsoft.public.sqlserver.xml)
    • RE: File()
      ... Mark ... "zzuffendoffer" wrote: ... > returned if I specify the path I want searched. ...
      (microsoft.public.fox.vfp.forms)
    • Re: [msh] Parameter input from argument or pipeline?
      ... specifying the destination as a named parameter. ... The pipeline input isn't processed until all named and ... it would be nice if I didn't have to specify the ...
      (microsoft.public.windows.server.scripting)