RE: SO_DONTROUTE, arp's, ipfw fwd, etc

2002-12-04 Thread Julian Elischer
On Wed, 4 Dec 2002, Don Bowman wrote: > > From: Julian Elischer [mailto:[EMAIL PROTECTED]] > > On Wed, 4 Dec 2002, Don Bowman wrote: > ... > > > It gets the destination MAC address from the SRC AMC field of the > > preceding incoming packets with that IP src, dst and port > > combination i

Re: SO_DONTROUTE, arp's, ipfw fwd, etc

2002-12-04 Thread Barney Wolff
On Wed, Dec 04, 2002 at 05:33:50PM -0500, Don Bowman wrote: > [client] > | > -- > | Load Balancer | > -- >| | >| |

RE: SO_DONTROUTE, arp's, ipfw fwd, etc

2002-12-04 Thread Don Bowman
> From: Julian Elischer [mailto:[EMAIL PROTECTED]] > On Wed, 4 Dec 2002, Don Bowman wrote: ... > It gets the destination MAC address from the SRC AMC field of the > preceding incoming packets with that IP src, dst and port > combination i.e. the node would look within the IP header. > > > >

RE: SO_DONTROUTE, arp's, ipfw fwd, etc

2002-12-04 Thread Julian Elischer
On Wed, 4 Dec 2002, Don Bowman wrote: > > From: Julian Elischer [mailto:[EMAIL PROTECTED]] > > On Wed, 4 Dec 2002, Don Bowman wrote: > > > > Why does it think the source is local? are the routers below > > > > doing proxy > > > > arp? Did you give your interface a netmask of 0,0.0.0? > > > > >

RE: SO_DONTROUTE, arp's, ipfw fwd, etc

2002-12-04 Thread Don Bowman
> From: Chuck Swiger [mailto:[EMAIL PROTECTED]] > On Wednesday, December 4, 2002, at 03:37 PM, Don Bowman wrote: > [ ... ] > > These are isp-sized routers (complicated networks with different > > peering points to other networks). Static routes don't work since > > they are much too dynamic. Addi

RE: SO_DONTROUTE, arp's, ipfw fwd, etc

2002-12-04 Thread Don Bowman
> From: Julian Elischer [mailto:[EMAIL PROTECTED]] > On Wed, 4 Dec 2002, Don Bowman wrote: > > > Why does it think the source is local? are the routers below > > > doing proxy > > > arp? Did you give your interface a netmask of 0,0.0.0? > > > > > > Who responds to the arp? > > > > Its a layer-2

RE: SO_DONTROUTE, arp's, ipfw fwd, etc

2002-12-04 Thread Julian Elischer
On Wed, 4 Dec 2002, Don Bowman wrote: > > Why does it think the source is local? are the routers below > > doing proxy > > arp? Did you give your interface a netmask of 0,0.0.0? > > > > Who responds to the arp? > > Its a layer-2 MAC rewrite, so it arrives on a local segment, but > subnetting ru

Re: SO_DONTROUTE, arp's, ipfw fwd, etc

2002-12-04 Thread Chuck Swiger
On Wednesday, December 4, 2002, at 03:37 PM, Don Bowman wrote: [ ... ] > These are isp-sized routers (complicated networks with different peering points to other networks). Static routes don't work since they are much too dynamic. Additionally, the widget which is picking the traffic to send (li

RE: SO_DONTROUTE, arp's, ipfw fwd, etc

2002-12-04 Thread Don Bowman
From: Julian Elischer [mailto:[EMAIL PROTECTED]] > The arp is issued because the TCP stack is responding to the > SYN packet with it's own SYN, but it doesn't have a route to the > origianal source, so it creates one, as it's local. this means that it > allocates an ARP entry for it which in turn

RE: SO_DONTROUTE, arp's, ipfw fwd, etc

2002-12-04 Thread Julian Elischer
On Wed, 4 Dec 2002, Don Bowman wrote: > > From: Don Bowman [mailto:[EMAIL PROTECTED]] > > I have a setup where I have a transparent proxy using ipfw fwd (to > > localhost). > > Data is sent to this device using a MAC rewrite so that > > packets arrive with > > my MAC, but the original source an

RE: SO_DONTROUTE, arp's, ipfw fwd, etc

2002-12-04 Thread Don Bowman
> -Original Message- > From: Chuck Swiger [mailto:[EMAIL PROTECTED]] > On Wednesday, December 4, 2002, at 03:20 PM, Don Bowman wrote: > > > What's happening is I have >1 router feeding me sessions which > > I'm transparently proxying (e.g. squid). > > Obviously I can't have a default rout

Re: SO_DONTROUTE, arp's, ipfw fwd, etc

2002-12-04 Thread Chuck Swiger
On Wednesday, December 4, 2002, at 03:20 PM, Don Bowman wrote: What's happening is I have >1 router feeding me sessions which I'm transparently proxying (e.g. squid). Obviously I can't have a default route back to each of them. So I have something like: [Router1]---\ \ [Router2]-

RE: SO_DONTROUTE, arp's, ipfw fwd, etc

2002-12-04 Thread Don Bowman
> From: Don Bowman [mailto:[EMAIL PROTECTED]] > I have a setup where I have a transparent proxy using ipfw fwd (to > localhost). > Data is sent to this device using a MAC rewrite so that > packets arrive with > my MAC, but the original source and destination IP. > When I receive the SYN, i accept

RE: SO_DONTROUTE, arp's, ipfw fwd, etc

2002-12-04 Thread Don Bowman
> From: Don Bowman [mailto:[EMAIL PROTECTED]] > I have a setup where I have a transparent proxy using ipfw fwd (to > localhost). > Data is sent to this device using a MAC rewrite so that > packets arrive with > my MAC, but the original source and destination IP. > When I receive the SYN, i accept

Re: Cjc's Ipfilter/Bridge patch

2002-12-04 Thread Luigi Rizzo
On Wed, Dec 04, 2002 at 02:32:19PM -0500, Garrett Wollman wrote: > < said: > > > root@heat[~]% sysctl -a | grep ipf | grep bridge > > net.link.ether.bridge_ipfw: 0 > > net.link.ether.bridge_ipf: 0 > > Grrr... Who's responsible for creating non-protocol nodes under > net.link.ether? that would be

Re: Cjc's Ipfilter/Bridge patch

2002-12-04 Thread Garrett Wollman
< said: > root@heat[~]% sysctl -a | grep ipf | grep bridge > net.link.ether.bridge_ipfw: 0 > net.link.ether.bridge_ipf: 0 Grrr... Who's responsible for creating non-protocol nodes under net.link.ether? -GAWollman To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-net" in

Re: Cjc's Ipfilter/Bridge patch

2002-12-04 Thread Eric Masson
> "randall" == randall ehren <[EMAIL PROTECTED]> writes: randall> hasn't it been merged? Can't find any trace in the cvsweb interface : http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/net/bridge.c?f=u&only_with_tag=RELENG_4&logsort=date And found the following comment in /sys/net/bridge.c #if

Re: Cjc's Ipfilter/Bridge patch

2002-12-04 Thread randall ehren
> I'd like to know whether the ipf/bridge patch located at : > http://people.freebsd.org/~cjc/ > > could be merged in the tree (-current then MFC) ? hasn't it been merged? root@heat[~]% uname -a FreeBSD fw.redigital.org 4.7-STABLE FreeBSD 4.7-STABLE #1: Tue Nov 26 19:42:57 PST 2002 [EMAIL PRO

Cjc's Ipfilter/Bridge patch

2002-12-04 Thread Eric Masson
Hello, I'd like to know whether the ipf/bridge patch located at : http://people.freebsd.org/~cjc/ could be merged in the tree (-current then MFC) ? Is there any showstopper ? TIA Eric Masson -- (...) mais le niveau des eaux a été l'oeuvre de grandes vallée dut aux glissements de terrains e

Re: FreeBSD <-> PIX IP comm problem - no ACK received

2002-12-04 Thread Dean Strik
Markus Stumpf wrote: > Problem: > I have an email message that is 3374 Bytes. It should be sent via SMTP > to another server that is behind a PIX Firewall. > The communiction gets tricky at the end of the message, because instead of > CR LF "." CR LF > packet N contains > data CR LF "." CR

FreeBSD <-> PIX IP comm problem - no ACK received

2002-12-04 Thread Markus Stumpf
I have searched with google and on freebsd.org but my problem is I don't know what exactly to search for :( The machine is a FreeBSD 4.4-RELEASE #0: Fri Oct 26 23:34:42 CEST 2001 CPU: Pentium III/Pentium III Xeon/Celeron (995.68-MHz 686-class CPU) Origin = "GenuineIntel" Id = 0x686

Anyone know about the WANic 520

2002-12-04 Thread Antony T Curtis
Please CC to me replies as I am not subscribed to all the lists. SBS's Datasheet for the WANic 520 lists it having drivers for FreeBSD... Does anyone have any experience with this card and FreeBSD, eg with Netgraph, frame relay, etc. Otherwise, could people suggest other serial cards? (I have

Re: jail: multiple ip's

2002-12-04 Thread Marko Zec
Terry Lambert wrote: > Tony Finch wrote: > > [EMAIL PROTECTED] (Mike Ghunt) wrote: > > > Has anyone hacked the jail code to support more than one ip? > > >Would it be wise to hack at the code to add such a feature? > > > > Probably the best way to address this issue is to incorporate the > > netw

Re: jail: multiple ip's

2002-12-04 Thread Terry Lambert
Note: Cross-post and "Reply-To:" of freebsd-net! Tony Finch wrote: > [EMAIL PROTECTED] (Mike Ghunt) wrote: > > Has anyone hacked the jail code to support more than one ip? > >Would it be wise to hack at the code to add such a feature? > > Probably the best way to address this issue is to incorpo