Re: ipfw help needed (IP vs TCP)

From: The Other Guy (null_at_null.void)
Date: 11/26/03 

Date: Thu, 27 Nov 2003 11:18:49 +1300

"Max Fine" <max29@yahoo.com> wrote in message
news:069xb.20794$Rk5.20278@newsread1.news.atl.earthlink.net...
> I am still a newbie at this so can someone please explain the difference
> between these two ipfw commands?
>
> ipfw add 1000 allow tcp from any to any
>
>
> ipfw add 1000 allow ip from any to any
>
> When I VPN to our company server from home behind my FreeBSD-4.9 gateway I
> can't connect unless I use the second command.
>
> I know I can narrow this rule down to the exact port eventually but for
now
> I just use this temporarily to gain access. I thought TCP was the protocol
> used by VPN?

A VPN can use a variety of packet types including TCP. My own VPN uses UDP.

> Any advice would be appreciated.

TCP packets are created inside IP packets. TCP is therefore a more specific
subset of IP, as is UDP or ICMP. Rules that apply to IP will apply
irrespective of what is contained in the IP packet. TCP rules will apply
only to packets containing TCP packets.

You will sometimes see TCP referred to as TCP/IP, and UDP as UDP/IP etc.

The Other Guy

Relevant Pages

  • FreeBSD Security Advisory: FreeBSD-SA-01:08.ipfw [REVISED]
    ... included in FreeBSD 4.0 and above. ... based on an old version of ipfw and does not contain as many features. ... Due to overloading of the TCP reserved flags field, ... incorrectly treat all TCP packets with the ECE flag set as being part ...
    (FreeBSD-Security)
  • FreeBSD Security Advisory: FreeBSD-SA-01:08.ipfw
    ... based on an old version of ipfw and does not contain as many features. ... Due to overloading of the TCP reserved flags field, ipfw and ip6fw ... incorrectly treat all TCP packets with the ECE flag set as being part ...
    (FreeBSD-Security)
  • Re: ipfw question
    ... # Pass and log all incoming ftp-data connections. ... ipfw add allow log tcp from any 20 to any in setup keep-state ... This way only the packets related to one of the states will pass ...
    (freebsd-questions)
  • Re: some ipfw filter does not function under Release 6.3
    ... Are you saying that the packets shown below from 221.192.199.36 arrived ... Is the tcpdump shown running on the same box as ipfw, ... ack 1 win 65535 ... But the rule 330 should only allow established TCP pass through. ...
    (freebsd-questions)
  • Re: DCPROMO RPC error
    ... Over the weekend I was involved in Joining a Windows 2003 server in the US to our domain here in Sydney over an IPSEC VPN. ... Kerberos uses connectionless UDP datagram packets. ... Depending on the virtual private network hardware configuration, these larger packets have to be fragmented when going through a VPN. ... Because UDP is a connectionless protocol, fragmented UDP packets will be dropped if they arrive at the destination out of order.If you change MaxPacketSize to a value of 1, you force the client to use TCP to send Kerberos traffic through the VPN tunnel. ...
    (microsoft.public.windows.server.active_directory)