03.09.2018 14:02, Runer wrote: > *Hello Community! > > A situation has arisen in which ipfw fwd stops working when > RTF_BLACKHOLE or RTF_REJECT, ROUTE (8), is enabled on Freebsd 11 release. > ** > > FreeBSD 11.2-RELEASE-p1 route add default 127.0.0.1 -blackhole –iface ipfw > show00100 30 4056 fwd 10.0.0.5 ip from table(1) to not 10.0.0.0/8 in via em0 > The packet counter changes, but forwarding does not work.On FreeBSD 10 > everything works fine. I suppose this is due to changes to forwarding -> fast > forwarding by default in FreeBSD 11 and man ROUTE (8), “BUGS - unless IP fast > forwarding is enabled, in which case the meaning of the flag will always be > honored.” > I want to know if it's possible to implement the work ipfw fwd together with > RTF_BLACKHOLE on FreeBSD 11 as before in FreeBSD 10? Thank you in advance! > > ***
As temporary workaround, you still can disable fast forwarding path: - make sure you use GENERIC kernel or your custom kernel has "options IPSEC_SUPPORT" like GENERIC has; - load ipsec kernel module by means of /boot/loader.conf or /etc/rc.conf; - add dummy security policy: printf "flush;\nspdflush;\n\nspdadd 100.64.0.1/32 100.64.0.2/32 esp -P out none;\n" > /etc/ipsec.conf It does nothing but prevents a kernel from using fast forwarding path for 11.2 _______________________________________________ freebsd-net@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
