ipfw: reset tcp

[Eugene Grosbein]

Luigi Rizzo wrote:

> > Please check. I suspect it does not enter ipfw itself,
> 
> yes it does skip the firewall, see ip_fw2.c:send_pkt() near the
> end:
> 
>         ip_rtaddr(ip->ip_dst, &sro);
> --->    m->m_flags |= M_SKIP_FIREWALL;
>         ip_output(m, NULL, &sro, 0, NULL, NULL);
> 
> removing the M_SKIP_FIREWALL would let ipfw process the
> packet too. HOWEVER: i think it is a bug in the general case
> to reprocess internally-generated packet, because you would rely
> on a correct ipfw configuration to avoid loops (which might not
> be the case).
> 
> I have no idea how ipfw1 used to do (and i am not goin to check!)
> but i don't think the generated packet did reenter the firewall.

I use ipfw2.

Please make it possible (using sysctl or any other mean) to
disable M_SKIP_FIREWALL for such packets (I suppose 'unreach' rules
are affected too). I DO need to process ALL outgoing packets.
For exapmle, I must use 'ipfw fwd' (to implement policy routing)
for the packets with source IP like this.

Eugene