On Wed, Sep 13, 2006 at 08:19:41PM +0200, Jon Otterholm wrote:
> Hi.
>
> According to man if_bridge one could filter L2-traffic with ipfw:
>
> From man if_bridge:
> ARP and REVARP packets are forwarded without being filtered and others
> that are not IP nor IPv6 packets are not forwarded when pfil_onlyip is
> enabled. IPFW can filter Ethernet types using mac-type so all packets
> are passed to the filter for processing.
>
> ARP is still forwarded though I have the following config:
>
> I have the following sysctl set:
>
> net.link.bridge.ipfw: 1
> net.link.bridge.pfil_member: 1
> net.link.bridge.pfil_bridge: 1
> net.link.bridge.pfil_onlyip: 1
>
> ipfw list:
>
> 65533 deny ip from any to any MAC any any
> 65534 deny ip from any to any layer2
> 65535 deny ip from any to any
The check for ARP happens before the ipfw layer2 code so it isnt
currently possible to filter them.
switch (ether_type) {
case ETHERTYPE_ARP:
case ETHERTYPE_REVARP:
return (0); /* Automatically pass */
You are the second person in so many days to ask this, is it something
that should be changed?
Andrew
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
