kern/128902: ipfw allow tcp from any to any established allow Sync
jguojun at gmail.com
Sat Nov 15 21:10:01 PST 2008
>Synopsis: ipfw allow tcp from any to any established allow Sync pass through
>Arrival-Date: Sun Nov 16 05:10:00 UTC 2008
>Originator: Jin Guojun
>Release: RELEASE 6.3
FreeBSD Belkin 6.3-RELEASE FreeBSD 6.3-RELEASE #0: Fri Oct 31 00:25:31 PDT 2008 root at Belkin:/usr/src/sys/i386/compile/Firewall i386
According to ipfw rule, the tcp established rule should allow only connected TCP traffic pass through. Non established TCP traffic (Sync packet) should not allowed to pass by this rule. However, this seems failing in RELEASED 6.3 (it seems working before as we used this rule for long time). The following rule set order should cut tcp connecting traffic from those 4 IP addresses, but it failed to do so.
00330 3108378 2700826874 allow tcp from any to any established
00361 0 0 deny ip from 18.104.22.168 to any
00361 0 0 deny ip from 22.214.171.124 to any
00567 0 0 deny ip from 126.96.36.199 to any
00567 0 0 deny ip from 188.8.131.52 to any
65535 2 120 deny ip from any to any
184.108.40.206 is a malicious site that probes computer holes around the whole world in period of every one half hour.
Set ipfw rule described in Full description and Listen on TCP port 80 to see TCP connection coming through.
If you have a outside IP (say XIP), you can set it in rule set 00555 for
00555 deny ip from XIP to any
and listen on a TCP port (say 12345) on local host, then send TCP traffic from XIP host to your local host TCP port 12345, and watch the traffic is passing through.
Have no looked into code yet, but by guessing, the ipfw did not take care the Sync case for established TCP rule, or it is bypassed or overwritten by other rules.
More information about the freebsd-bugs