Re: ipfw problems?

On Tue, Apr 25, 2006 at 02:34:03PM +0200, Ivan Voras wrote:

I forgot to add, here is the ipfw ruleset:

00500 691658783 639225488899 allow ip from any to any via lo0
01000 99014 6833994 allow icmp from any to any
05000 160430605 76502643136 allow tcp from me to any setup keep-state
05100 1002529 109535100 allow udp from me to any keep-state
05500 6900233 3554390307 allow tcp from X.X.X.107 to me setup keep-state
05505 0 0 allow udp from X.X.X.107 to me keep-state
06022 258788 52462014 allow tcp from X.X.X.0/24 to me dst-port 22
setup keep-state
06080 300599299 153827836772 allow tcp from any to me dst-port 80 setup
keep-state
06443 9801709 3876114253 allow tcp from any to me dst-port 443 setup
keep-state
65400 2381270 592034925 deny log ip from any to any
65535 0 0 deny ip from any to any
_______________________________________________
freebsd-stable@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscribe@xxxxxxxxxxx"

Next time this happen check following sysctls:
net.inet.ip.fw.dyn_max
net.inet.ip.fw.dyn_count

I guess you've hit the limit.


--
Oleg.

_______________________________________________
freebsd-stable@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: Dynamic Rules with IPFW
    ... > ipfw add deny tcp from any to any established ... > ipfw add allow tcp from my-net to any setup keep-state ... > allow tcp from any to my-net 25,80,443 setup in via xl0 keep-state ...
    (FreeBSD-Security)
  • Re: slow connection on default to deny ipfw rules
    ... I do allow icmp from any to any, can it be because i have an established ... 10202 allow tcp from any to any established ... 10902 allow ip from 10.0.5.0/24 to 10.0.5.0/24 keep-state ... >> I have a NAT box with a default to deny ipfw ruleset. ...
    (comp.unix.bsd.freebsd.misc)
  • Re: Help with FreeBSD pf.
    ... pass udp from me to any keep-state ... pass icmp from any to me icmptypes 3,4,11 ... Removed setup from the TCP rule. ...
    (comp.unix.bsd.freebsd.misc)
  • IPFW: DMZ and LAN question
    ... I will have a DMZ and my local LAN. ... ipfw add 00181 allow all from any to any via $keep-state ... ipfw add 00375 allow log tcp from any to any 21 out via $setup ...
    (comp.security.firewalls)
  • Re: ipfw - skipto
    ... setup keep-state ... 00070 skipto 800 tcp from me to any out via tun0 setup uid root keep-state ...
    (comp.unix.bsd.freebsd.misc)