On Mon, 29 Sep 2014 20:21:58 -0400, Jack Barber wrote:
> We are having trouble getting ipfw to work over a bridged interface.
>
> for example:
>
> machine 1 -> Bridged interface FreeBSD 10 -> machine 2.
>
> machine 1 - 192.168.20.20
> machine 2 - 192.168.20.25
>
> now I set something like this in /etc/ipfw.rules:
>
> $IPFWcmd add deny all from 192.168.20.20/24 to any
> $IPFWcmd add deny all from any to 192.168.20.20/24
>
> where both machine 1 and machine 2 are on said subnet and already work.
Please confirm that these two are only connected via two interfaces on
the bridge/ipfw box, with no switch involved? And that these rules,
once working, should deny traffic between ANY hosts in this /24 subnet?
> when I reload the rules, I am unable to stop a connection between
> machine 1 and machine 2.
>
> I've already made sure that ipfw is running(loaded), and the rules
> appear to take, and even show up with "ipfw show".
>
> # ipfw show
> ...
> 01700 0 0 deny ip from 192.168.20.0/24 to any
> 01800 0 0 deny ip from any to 192.168.20.0/24
> 65535 9227 11389032 allow ip from any to any
>
> However, there is no effect on data travelling over the pipe at all.
>
> This setup was confirmed many times to work with FreeBSD 9.2, but it
> does not work on 10. any help is appreciated.
What values are set for these sysctls?
net.link.ether.ipfw: 0
Controls whether layer-2 packets are passed to ipfw. Default is
no.
net.link.bridge.ipfw: 0
Controls whether bridged packets are passed to ipfw. Default is
no.
cheers, Ian
_______________________________________________
freebsd-ipfw@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "freebsd-ipfw-unsubscr...@freebsd.org"
