clarification regarding netgraph and ipfw

From: Glenn Dawson (glenn_at_antimatter.net)
Date: 07/30/04

  • Next message: Glenn Dawson: "Re: clarification regarding netgraph and ipfw" 
    Date: Thu, 29 Jul 2004 23:59:44 -0700
To: stable@freebsd.org

    Greetings,

    I have a firewall running -STABLE. I'm using ipfw2 for filtering and
    ng_netgraph (via ng_tee) to export netflow data.

    According to the man page for ng_ether, the lower hook gets raw ethernet
    frames as they come off the wire. Reading the man page for ipfw it seems
    to say that if I turn on net.link.ether.ipfw in sysctl that it will also
    get things as they come off the wire.

    So my question is, which one gets them first?

    The reason I ask is that if I have an ipfw rule to block traffic from an
    IP, will it get counted by ng_netgraph? Or will ipfw drop the packet
    before it even gets to ng_ether?

    If the packets go through ng_ether first and then through ipfw, does anyone
    know if it's possible to reverse that behavior? I'm doing billing based on
    traffic and don't want the netflow data to include packets that were
    dropped by ipfw.

    Thanks in advance for any insight.

    -Glenn

    _______________________________________________
    freebsd-stable@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-stable
    To unsubscribe, send any mail to "freebsd-stable-unsubscribe@freebsd.org"

  • Next message: Glenn Dawson: "Re: clarification regarding netgraph and ipfw"

    Relevant Pages

    • Re: clarification regarding netgraph and ipfw
      ... Reading the man page for ipfw it seems ... >get things as they come off the wire. ... >If the packets go through ng_ether first and then through ipfw, ...
      (freebsd-stable)
    • RE: clarification regarding netgraph and ipfw
      ... > According to the man page for ng_ether, the lower hook gets raw ethernet ... Reading the man page for ipfw it seems ... > get things as they come off the wire. ... > If the packets go through ng_ether first and then through ipfw, ...
      (freebsd-stable)
    • Re: [PATCH] ng_tag - new netgraph node, please test (L7 filtering possibility)
      ... For simple using, however, you don't need to bother all that details - just remember magic number and where to place it, and it is now simple for use with ipfw tags. ... Currently the only analyzing node in FreeBSD src tree is ng_bpf, but it merely splits incoming packets in two streams, matched and not. ... There are reasons to this, as netgraph needs to be modular, and each node does a small thing, but does it well. ... For long time ng_bpf was used for another purposes in the kernel, and now, as new ipfw features appeared, ng_tag came up for easy integration. ...
      (freebsd-current)
    • Re: [PATCH] ng_tag - new netgraph node, please test (L7 filtering possibility)
      ... For simple using, however, you don't need to bother all that details - just remember magic number and where to place it, and it is now simple for use with ipfw tags. ... Currently the only analyzing node in FreeBSD src tree is ng_bpf, but it merely splits incoming packets in two streams, matched and not. ... There are reasons to this, as netgraph needs to be modular, and each node does a small thing, but does it well. ... For long time ng_bpf was used for another purposes in the kernel, and now, as new ipfw features appeared, ng_tag came up for easy integration. ...
      (freebsd-isp)
    • Re: [PATCH] ng_tag - new netgraph node, please test (L7 filtering possibility)
      ... For simple using, however, you don't need to bother all that details - just remember magic number and where to place it, and it is now simple for use with ipfw tags. ... Currently the only analyzing node in FreeBSD src tree is ng_bpf, but it merely splits incoming packets in two streams, matched and not. ... There are reasons to this, as netgraph needs to be modular, and each node does a small thing, but does it well. ... For long time ng_bpf was used for another purposes in the kernel, and now, as new ipfw features appeared, ng_tag came up for easy integration. ...
      (freebsd-net)