ipfw -pf processing order

Robert Usle robertusn at gmail.com
Sun Jun 19 11:01:44 GMT 2005


Hi,

I'm using FreeBSD 5.4 with ipfw (module) & pf (kernel compiled) firewall.

pf is used for nat, pass/block, rdr, and dummynet/ipfw is used only
for packet queueing.

ext_if = vr0
int_if = rl1

ipfw rules:
/sbin/ipfw pipe 10 config bw 256Kbit/s queue 20 mask dst-ip 0x000000ff
/sbin/ipfw pipe 11 config bw 256Kbit/s queue 20 mask src-ip 0x000000ff
/sbin/ipfw add 100 pipe 10 log ip from any to 10.0.9.0/24 
/sbin/ipfw add 101 pipe 11 log ip from 10.0.9.0/24 to any 

sysctl: net.inet.ip.fw.one_pass: 1
(I've also tried with 'via','xmit','recv' tags)

I see packets coming to my dummynet pipes/rules, but then 
pf rdr rule:

rdr on $int_if proto tcp from $internal_net to any port 80 ->
127.0.0.1 port 3128

does not work.
When i disable ipfw firewall, it's just ok again.

pf options are as follows:
set optimization normal
set block-policy drop
set require-order yes
scrub in all

Is this related to firewall processing order ?

Thanks,

-- 
Robert


More information about the freebsd-pf mailing list