IP Filter problems on 4.11-STABLE

[fbsd_user]

Your firewall rules are pretty much useless.
Your default is to pass everything that does not match a rule.
So other than those block rules everything is allowed out and in.

This means your slowness problem has nothing to do with your
firewall.
Read the handbook for ipfilter sample rule set if you want
a meaningful firewall.

-----Original Message-----
From: owner-freebsd-questions at freebsd.org
[mailto:owner-freebsd-questions at freebsd.org]On Behalf Of B H
Sent: Wednesday, March 29, 2006 4:06 AM
To: freebsd-questions at FreeBSD. ORG
Subject: IP Filter problems on 4.11-STABLE


Hello!


I've upgrade a machine about a week ago from 4.10-p19 i belive it
was.

Now IPFilter does not work or is VERY slow, ssh, web and mail
timesout.

NAT is working like it should.

# dmesg | grep 'IP Filter'
IP Filter: v3.4.35 initialized.  Default = pass all, Logging =
enabled

ipf.rules looks like this:

# Let clients behind the firewall send out to the internet, and
replies to
# come back in by keeping state.
pass out quick on fxp0 proto tcp all keep state
pass out quick on fxp0 proto udp all keep state
pass out quick on fxp0 proto icmp all keep state

# Since nothing should be coming from these address ranges, block
them
block in log quick on fxp0 from 82.182.0.0/16 to any
block in quick on fxp0 from 192.168.0.0/16 to any
block in quick on fxp0 from 172.16.0.0/12 to any
block in quick on fxp0 from 10.0.0.0/8 to any
block in quick on fxp0 from 127.0.0.0/8 to any
block in quick on fxp0 from 192.0.2.0/24 to any
block in log quick on fxp0 from any to 10.0.0.0/32
block in log quick on fxp0 from any to 10.0.0.255/32

_______________________________________________
freebsd-questions at freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to
"freebsd-questions-unsubscribe at freebsd.org"