Are you sure you don't have some other rule which is letting those returned
packets out the other port? When I substitute your rule for my two:
ipfw delete 10531
ipfw delete 10532
ipfw add 10531 allow icmp from any to any icmptypes 0,3,11,12 in
The returning packets are dropped inside the firewall. (traceroute still
works from the firewall itself, but not from an internal machine).
Gary
Dan Nelson wrote:
In the last episode (Oct 31), Ivan Voras said:
[EMAIL PROTECTED] wrote:
add 10510 allow icmp from any to any out via oif() keep-state
I don't think ICMP is stateful :)
You need both in and out rules for ICMP because the logical responses
to packets can't be reliably connected into a single communication.
I use "allow icmp from any to any icmptypes 0,3,11,12 in"
those types being "echo reply", "destination unreachable",
"time-to-live exceeded", and "IP header bad".
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
