> > Well, I am a little bit confused, because usually, I run machines with > > "real" NICs and if I activate firewall rules that drop packets from > > that NIC, I can run tcpdump on that NIC and will not see the dropped > > packets. > > Are you 100% certain of that?
No, I now realize, that I was always inspecting ipfw's log messages and just assumed that dropped packets do not appear to tcpdump without ever verifying that assumption. Thanks for pointing that out. > > Does that mean, that there is no way, to inspect the network > > traffic from tun0 after it has been "cleaned up" by ipfw and that is > > not forwarded to the internal NIC? > > You can either add a log rule after your IPFW reject rules, and have the > firewall itself log the traffic which is permitted through, or you could use > another divert rule and force that traffic into a daemon which looks at the > packets (this is how natd works, after all). I guess, I will use ipfw's logging facility. Thanks again for clarification. Dirk _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
