From nobody Sun Oct 15 17:46:57 2023 X-Original-To: freebsd-net@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4S7nkJ68Z9z4xCpL for ; Sun, 15 Oct 2023 17:47:04 +0000 (UTC) (envelope-from paul@redbarn.org) Received: from util.redbarn.org (util.redbarn.org [IPv6:2001:559:8000:cd::222]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "*.redbarn.org", Issuer "RapidSSL Global TLS RSA4096 SHA256 2022 CA1" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4S7nkH6v9Vz4Z1q for ; Sun, 15 Oct 2023 17:47:03 +0000 (UTC) (envelope-from paul@redbarn.org) Authentication-Results: mx1.freebsd.org; none Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "*.redbarn.org", Issuer "RapidSSL Global TLS RSA4096 SHA256 2022 CA1" (not verified)) by util.redbarn.org (Postfix) with ESMTPS id 05D97160B46; Sun, 15 Oct 2023 17:46:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=redbarn.org; s=util; t=1697392019; bh=nBrUgRs8+MZCVyMwUar9cnYLHGx4mNV0om4zS7mZml0=; h=Date:Subject:In-Reply-To:References:From:To; b=lUEVY6SNwEQcU9CsX4JS8zubL0dBBaUjKRrg03jaU6ukSsxcKknFS1z9DKGULjp2m prTbGPr7yqszrKkJb3RQgRe0Rem0fOztS1MFDPdg9S/lKxvKpjhAedW3gvXDkf3Wcf TEWsNuwOvHg+ASWioTWFgYtNaAGXeOiefh59pwaQ= Received: from [24.104.150.145] (dhcp-145.access.rits.tisf.net [24.104.150.145]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id C2A78FEBEE; Sun, 15 Oct 2023 17:46:58 +0000 (UTC) Date: Sun, 15 Oct 2023 10:46:57 -0700 Subject: ipfw firewalling for bhyve host, bypassing bhyve guests Message-ID: <4a9fd232-e6be-432c-96c1-2ffb80ec09b8@redbarn.org> In-Reply-To: References: From: Paul Vixie To: freebsd-net@freebsd.org, void List-Id: Networking and TCP/IP with FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-net List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-net@freebsd.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="--_com.boxer.email_569146753904192" X-Spamd-Bar: ---- X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; ASN(0.00)[asn:33651, ipnet:2001:559:8000::/48, country:US] X-Rspamd-Queue-Id: 4S7nkH6v9Vz4Z1q ----_com.boxer.email_569146753904192 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: base64 WW91IGRvbid0IG5lZWQgTDIgZm9yIHRoaXMuIFRoZSBmaXJld2FsbCBwYXR0ZXJuIHdoZW4geW91 ciBiYXJlIG1ldGFsIGhvc3QgaGFzIGFuIGFkZHJlc3MgaW4gdGhlIHZsYW4geW91IHVzZSBmb3Ig Z3Vlc3RzIGlzOiAKCgpBbGxvdyB0aGUgc3BlY2lmaWMgdGhpbmdzIHlvdSB3YW50IHRoZSBiYXJl IG1ldGFsIGhvc3QgdG8gZG87IAoKCkRlbnkgYWxsIGVsc2UgaW52b2x2aW5nIHRoZSBiYXJlIG1l dGFsIGhvc3Q7IAoKCkFsbG93IGFsbCBlbHNlIGludm9sdmluZyB0aGUgZ3Vlc3Qgc3VibmV0LiAK CgpwIHZpeGllIAoKCk9uIE9jdCAxNSwgMjAyMyAwNzoxNCwgdm9pZCA8dm9pZEBmLW0uZm0+IHdy b3RlOgoKSGVsbG8sIAoKTXkgb2JqZWN0aXZlIGlzIHRvIHByb3RlY3Qgc2VydmljZXMgb24gYSBi aHl2ZSBob3N0LCB3aGlsZSBhbGxvd2luZyB0cmFmZmljIAp0byB0aGUgYmh5dmUgZ3Vlc3RzIHRv IHBhc3MgdG8gdGhlbSB1bnByb2Nlc3NlZCwgYXMgdGhlc2UgZWFjaCBoYXZlIHBmIGFuZCAKdGhl aXIgb3duIGZpcmV3YWxsIHBvbGljaWVzLiBUaGUgaG9zdCBydW5uaW5nIGFuIHVwLXRvLWRhdGUg MTMtc3RhYmxlLiAKCkkga25vdyBpcGZ3IGNhbiBwcm9jZXNzIGJvdGggbGF5ZXIgMiBhbmQgbGF5 ZXIgMyB0cmFmZmljLCBidXQgcGYgb25seSBwcm9jZXNzZXMgCmxheWVyIDMgc28gdGhhdCBpcyB3 aHkgaSB3YW50IHRvIHVzZSBpcGZ3IG9uIHRoZSBiaHl2ZSBob3N0LiAKClNvIHdlIGhhdmUgYnJp ZGdlMCB3aXRoIGlnYjAgdGFwMCBhbmQgdGFwMSBhcyBtZW1iZXJzLiAKSW4gdGhpcyBleGFtcGxl LCBpZ2IwIGhhcyBhIG1hYyBhZGRyZXNzIG9mIDExOjExOjExOjExOjExOjExIAp0YXAwIGhhcyAy MjoyMjoyMjoyMjoyMjoyMiAKdGFwMSBoYXMgMzM6MzM6MzM6MzM6MzM6MzMgCgpIb3cgY2FuIEkg dGVsbCBpcGZ3IHRvIHBhc3MgMjI6MjI6MjI6MjI6MjI6MjIgYW5kIDMzOjMzOjMzOjMzOjMzOjMz IGFuZCBhcHBseSAKbm8gbW9yZSBydWxlcyB0byBmcmFtZXMgbWF0Y2hpbmcgdGhvc2UgTUFDcz8g CgpMZXQncyBzYXkgSSB3YW50IHRvIGp1c3QgYmxvY2sgb24gMTE6MTE6MTE6MTE6MTE6MTEgKGln YjApIHBvcnQgMjIgCmFwYXJ0IGZyb20gMTAuMC4wLjAvMjQgCgoyMjoyMjoyMjoyMjoyMjoyMiBw YXNzaW5nIHVuaGluZGVyZWQsIHVucHJvY2Vzc2VkLiAKClBvc3NpYmxlPyAKCi0tIAoK ----_com.boxer.email_569146753904192 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: base64 PGh0bWw+CiA8aGVhZD48L2hlYWQ+CiA8Ym9keT4KICA8ZGl2IGRpcj0ibHRyIj4KICAgWW91IGRv bid0IG5lZWQgTDIgZm9yIHRoaXMuIFRoZSBmaXJld2FsbCBwYXR0ZXJuIHdoZW4geW91ciBiYXJl IG1ldGFsIGhvc3QgaGFzIGFuIGFkZHJlc3MgaW4gdGhlIHZsYW4geW91IHVzZSBmb3IgZ3Vlc3Rz IGlzOgogIDwvZGl2Pjxicj4KICA8ZGl2IGRpcj0ibHRyIj4KICAgQWxsb3cgdGhlIHNwZWNpZmlj IHRoaW5ncyB5b3Ugd2FudCB0aGUgYmFyZSBtZXRhbCBob3N0IHRvIGRvOwogIDwvZGl2Pjxicj4K ICA8ZGl2IGRpcj0ibHRyIj4KICAgRGVueSBhbGwgZWxzZSBpbnZvbHZpbmcgdGhlIGJhcmUgbWV0 YWwgaG9zdDsKICA8L2Rpdj48YnI+CiAgPGRpdiBkaXI9Imx0ciI+CiAgIEFsbG93IGFsbCBlbHNl IGludm9sdmluZyB0aGUgZ3Vlc3Qgc3VibmV0LgogIDwvZGl2Pjxicj4KICA8ZGl2IGRpcj0ibHRy Ij4KICAgcCB2aXhpZQogIDwvZGl2Pjxicj4KICA8ZGl2IGNsYXNzPSJieC1odG1sIj4KICAgPGRp diBjbGFzcz0iYngtYm9keSI+CiAgICA8ZGl2IGNsYXNzPSJxdW90ZSI+CiAgICAgT24gT2N0IDE1 LCAyMDIzIDA3OjE0LCB2b2lkICZsdDt2b2lkQGYtbS5mbSZndDsgd3JvdGU6PGJyIHR5cGU9ImF0 dHJpYnV0aW9uIj4KICAgICA8YmxvY2txdW90ZSBjbGFzcz0icXVvdGUiIHN0eWxlPSJtYXJnaW46 MCAwIDAgLjhleDtib3JkZXItbGVmdDoxcHggI2NjYyBzb2xpZDtwYWRkaW5nLWxlZnQ6MWV4Ij4K ICAgICAgPHAgZGlyPSJsdHIiPkhlbGxvLCA8YnI+PGJyPgogICAgICAgIE15IG9iamVjdGl2ZSBp cyB0byBwcm90ZWN0IHNlcnZpY2VzIG9uIGEgYmh5dmUgaG9zdCwgd2hpbGUgYWxsb3dpbmcgdHJh ZmZpYyA8YnI+CiAgICAgICAgdG8gdGhlIGJoeXZlIGd1ZXN0cyB0byBwYXNzIHRvIHRoZW0gdW5w cm9jZXNzZWQsIGFzIHRoZXNlIGVhY2ggaGF2ZSBwZiBhbmQgPGJyPgogICAgICAgIHRoZWlyIG93 biBmaXJld2FsbCBwb2xpY2llcy4gVGhlIGhvc3QgcnVubmluZyBhbiB1cC10by1kYXRlIDEzLXN0 YWJsZS4gPGJyPjxicj4KICAgICAgICBJIGtub3cgaXBmdyBjYW4gcHJvY2VzcyBib3RoIGxheWVy IDIgYW5kIGxheWVyIDMgdHJhZmZpYywgYnV0IHBmIG9ubHkgcHJvY2Vzc2VzIDxicj4KICAgICAg ICBsYXllciAzIHNvIHRoYXQgaXMgd2h5IGkgd2FudCB0byB1c2UgaXBmdyBvbiB0aGUgYmh5dmUg aG9zdC4gPGJyPjxicj4KICAgICAgICBTbyB3ZSBoYXZlIGJyaWRnZTAgd2l0aCBpZ2IwIHRhcDAg YW5kIHRhcDEgYXMgbWVtYmVycy4gPGJyPgogICAgICAgIEluIHRoaXMgZXhhbXBsZSwgaWdiMCBo YXMgYSBtYWMgYWRkcmVzcyBvZiAxMToxMToxMToxMToxMToxMSA8YnI+CiAgICAgICAgdGFwMCBo YXMgMjI6MjI6MjI6MjI6MjI6MjIgPGJyPgogICAgICAgIHRhcDEgaGFzIDMzOjMzOjMzOjMzOjMz OjMzIDxicj48YnI+CiAgICAgICAgSG93IGNhbiBJIHRlbGwgaXBmdyB0byBwYXNzIDIyOjIyOjIy OjIyOjIyOjIyIGFuZCAzMzozMzozMzozMzozMzozMyBhbmQgYXBwbHkgPGJyPgogICAgICAgIG5v IG1vcmUgcnVsZXMgdG8gZnJhbWVzIG1hdGNoaW5nIHRob3NlIE1BQ3M/IDxicj48YnI+CiAgICAg ICAgTGV0J3Mgc2F5IEkgd2FudCB0byBqdXN0IGJsb2NrIG9uIDExOjExOjExOjExOjExOjExIChp Z2IwKSBwb3J0IDIyIDxicj4KICAgICAgICBhcGFydCBmcm9tIDEwLjAuMC4wLzI0IDxicj48YnI+ CiAgICAgICAgMjI6MjI6MjI6MjI6MjI6MjIgcGFzc2luZyB1bmhpbmRlcmVkLCB1bnByb2Nlc3Nl ZC4gPGJyPjxicj4KICAgICAgICBQb3NzaWJsZT8gPGJyPjxicj4KICAgICAgICAtLSA8YnI+PGJy PjwvcD4KICAgICA8L2Jsb2NrcXVvdGU+CiAgICA8L2Rpdj4KICAgPC9kaXY+CiAgPC9kaXY+CiA8 L2JvZHk+CjwvaHRtbD4= ----_com.boxer.email_569146753904192--