per-interface packet filters [summary]

James james at towardex.com
Wed Dec 15 01:44:12 PST 2004


On Wed, Dec 15, 2004 at 12:13:29PM +0300, Gleb Smirnoff wrote:
> On Wed, Dec 15, 2004 at 03:49:09AM -0500, James wrote:
> J> On Wed, Dec 15, 2004 at 11:45:40AM +0300, Gleb Smirnoff wrote:
> J> > On Tue, Dec 14, 2004 at 01:12:31PM -0500, James wrote:
> J> > J> The way we have approached this in the past is to install /32 host routes
> J> > J> for each interface addr's and respective subnet and broadcast /32 addresses
> J> > J> into the kernel RIB, destined to lo0 interface. Place your per-interface
> J> > J> filter on 'lo0' interface and packets destined to router iteslf will be
> J> > J> subject to loopback filter before making it onto upper layer protocol.
> J> > 
> J> > I was thinking of this idea, too. So, it works?
> J> 
> J> It works indeed. If folks want me to, I'll provide patches to ip_fastfwd.c
> J> after christmas-new-year break. (I have too much stuff on my plate right now)
> 
> Please do it.

Roger. Will post when done.

-J

-- 
James Jun                                            TowardEX Technologies, Inc.
Technical Lead                      Boston IPv4/IPv6 Web Hosting, Colocation and
james at towardex.com            Network design/consulting & configuration services
cell: 1(978)-394-2867           web: http://www.towardex.com , noc: www.twdx.net


More information about the freebsd-net mailing list