Ipfw accept rule

[Bikrant Neupane]

On Friday 24 September 2004 15:26, dima wrote:
> В пт, 24.09.2004, в 10:20, Bikrant Neupane пишет:
> > On Thursday 23 September 2004 22:29, Jon Simola wrote:
> > > On Thu, 23 Sep 2004, Bikrant Neupane wrote:
> > > > Here is my rule set:
> > > >
> > > > #skip dependind the pkt layer
> > > > 01000   322    14780 skipto 10000 ip from any to any layer2 in via
> > > > xl0 01100   200    93204 skipto 20000 ip from any to any not layer2
> > > >
> > > > #rule num 10000 to 20000 allocated for layer2 filtering
> > > > #for mac filter: allow only listed mac to send traffic
> > > > 10000    39     1780 allow ip from any to any MAC any
> > > > 00:00:0e:84:00:83 in via xl0
> > > > #default deny all mac coming in from xl0
> > > > 19997   284    13046 deny ip from any to any MAC any any in via xl0
> > >
> > > If this is layer2 filtering, where are the layer2 tags in the ipfw
> > > rule? And if this is the extent of your layer 2, then don't forget an
> > > allow/deny default for layer2 packets (allow ip from any to any
> > > layer2). Also, you're only checking your layer2 on a specific
> > > interface, perhaps you only have one.
> > >
> > > I've got something like:
> > > 00010 skipto 32000 ip from any to any not layer2
> > > 00050 deny ip from any to any MAC any 00:30:da:00:00:00/24 layer2 in
> > > 00055 count ip from any to any MAC any 00:0b:db:1d:63:56 layer2 in //
> > > sniffing for traffic 03100 allow ip from any to any layer2
> > > // bandwidth monitoring pipes
> > > 32003 pipe 3 ip from any to any src-ip 10.10.66.0/24 in recv em1
> > > 32004 pipe 4 ip from any to any dst-ip 10.10.66.0/24 out xmit em1
> > > 65534 allow ip from any to any
> > > 65535 deny ip from any to any
> >
> > Well, I have no problem with the MAC filtering rules.
> > Only problem that I am having is that the pkts hit the matching rule
> > twice as a result I get only half of the b/w than that specified in ipfw
> > pipe command.
> >
> >
> > 35004   324   485880 pipe 202 ip from any to 202.79.45.254 out via xl0
> > 35005   302    12080 pipe 203 ip from 202.79.45.254 to any out via em0
> >
> > Isn't there a way to construct rules such that matching pkts hit the rule
> > only once?
>
> $ man ipfw
> [skip]
> pipe pipe_nr
>     Pass packet to a dummynet(4) ``pipe'' (for bandwidth limitation,
>     delay, etc.).  See the TRAFFIC SHAPER (DUMMYNET) CONFIGURATION
>     Section for further information.  The search terminates; however,
>     on exit from the pipe and if the sysctl(8) variable
>     net.inet.ip.fw.one_pass is not set, the packet is passed again to
>     the firewall code starting from the next rule.
> [skip]
# sysctl -a net.inet.ip.fw.one_pass
net.inet.ip.fw.one_pass: 1
It is by default 1.

I tried with 0 as well

Bikrant

> $