ipfw and tun0
gouders at et.bocholt.fh-ge.de
Sun Jul 24 18:31:32 GMT 2005
> > Well, I am a little bit confused, because usually, I run machines with
> > "real" NICs and if I activate firewall rules that drop packets from
> > that NIC, I can run tcpdump on that NIC and will not see the dropped
> > packets.
> Are you 100% certain of that?
No, I now realize, that I was always inspecting ipfw's log messages
and just assumed that dropped packets do not appear to tcpdump without
ever verifying that assumption. Thanks for pointing that out.
> > Does that mean, that there is no way, to inspect the network
> > traffic from tun0 after it has been "cleaned up" by ipfw and that is
> > not forwarded to the internal NIC?
> You can either add a log rule after your IPFW reject rules, and have the
> firewall itself log the traffic which is permitted through, or you could use
> another divert rule and force that traffic into a daemon which looks at the
> packets (this is how natd works, after all).
I guess, I will use ipfw's logging facility.
Thanks again for clarification.
More information about the freebsd-questions