IPFW Problems

[Andrew Pantyukhin]

On 4/20/06, Drew Tomlinson <drew at mykitchentable.net> wrote:
> On 4/17/2006 2:29 PM Noah Silverman wrote:
> > Hi,
> >
> > I have a system with a 4.11 Kernel.  Unless I'm doing something very
> > wrong, there seems to be something odd with ipfw.
> >
> > Take the following rules:
> I assume above this you have "ipfw add check-state" defined?  This is
> the rule that's required to get ipfw to check its dynamic rule set.
> Without it, "keep-state" rules will never work.

No, this is not required. The dynamic rules are checked
at first keep-state or limit, too.

> > ipfw add 00280 allow tcp from any to any 22 out via bge0 setup keep-state
> > ipfw add 00299 deny log all from any to any out via bge0
> > ipfw add 0430 allow log tcp from any to me 22 in via bge0 setup limit
> > src-addr 2
> I think this line is your problem.  "setup" matches the initial packet
> with the syn flag set.  However since you have not added "keep-state",
> no rule gets added to the dynamic rule set for this connection.
> Subsequent packets don't match because "syn" is not set.  Thus they hit
> rule 499 and are denied.

Yes. 'setup' is from "semi-stateful" firewall functionality while
'keep-state' is from fully stateful one. You can't use both in
one rule without strange consequences. Just delete 'setup'
words in both rules - it'll probably be fine.