FreeBSD bridge + filtering, BIG problem

Pyun YongHyeon yongari at kt-is.co.kr
Wed Dec 1 19:39:25 PST 2004


On Wed, Dec 01, 2004 at 08:23:39AM -0500, Josh Kayse wrote:

[...]
 > 
 > I know it's been touched on in the past, but can you explain why
 > stateful inspection does not work in a bridged mode?  And why it only
 > filters for inbound traffic?  Does ipfw suffer from the same feature? 
 > Thanks.
 > 

Both pf/ipf should see inbound/outbound traffic in order to
create states. But in bridge(4), pfil(9) hook for outbound packet
is absent. ipfw can create states without seeing outbound packet.
Maybe it would be authors intention to reduce overhead by not
checking packets in both directions.

I guess ipfw can't filter outbound packet in bridged setup too.

Long time ago, I wrote a patch to add pfil(9) outbound hook
in bridge setup. The patch makes pf's scrub rule work too.
It wouldn't apply to 5.3R but you can see the point.

http://www.kr.freebsd.org/~yongari/patches/bridge.patch

 > -josh
 > 
 > -- 
 > Joshua Kayse
 > Computer Engineering

-- 
Regards,
Pyun YongHyeon
http://www.kr.freebsd.org/~yongari	|	yongari at freebsd.org


More information about the freebsd-pf mailing list