ipfw and tun0

[Dirk GOUDERS]

 > > Well, I am a little bit confused, because usually, I run machines with
 > > "real" NICs and if I activate firewall rules that drop packets from
 > > that NIC, I can run tcpdump on that NIC and will not see the dropped
 > > packets.
 > 
 > Are you 100% certain of that?

No, I now realize, that I was always inspecting ipfw's log messages
and just assumed that dropped packets do not appear to tcpdump without
ever verifying that assumption.  Thanks for pointing that out.

 > > Does that mean, that there is no way, to inspect the network
 > > traffic from tun0 after it has been "cleaned up" by ipfw and that is
 > > not forwarded to the internal NIC?
 > 
 > You can either add a log rule after your IPFW reject rules, and have the 
 > firewall itself log the traffic which is permitted through, or you could use
 > another divert rule and force that traffic into a daemon which looks at the 
 > packets (this is how natd works, after all).

I guess, I will use ipfw's logging facility.

Thanks again for clarification.

Dirk