Displaying 20 results from an estimated 1100 matches similar to: "4.8-Stable DummyNet"
2004 Feb 19
2
traffic normalizer for ipfw?
Hi there,
Is there some way to configure ipfw to do traffic
normalizing ("scrubbing", as in ipf for OpenBSD)? Is
there any tool to do it for FreeBSD firewalling?
I've heard that ipf was ported on current, anything
else?
TIA,
/Dorin.
__________________________________
Do you Yahoo!?
Yahoo! Mail SpamGuard - Read only the mail you want.
http://antispam.yahoo.com/tools
2003 Oct 20
1
Equal bandwidth configuration among host with dummynet
Hi all,
First of all, I have spent a lot of time reading up on
it.
Anyway, I live in a shared accomodation with 2
roommates and a landlord and we share a cable internet
connection. It is 2Mbit/400Kbit connection. Sometimes
when one of us is downloading a song through Kazaa or
a new Linux or FreeBSD iso, the bandwidth gets hogged
and other users can't get through.
I was trying to configure
2003 Sep 15
5
strange problem with: ed driver / 4.9-PRE
Hi,
in the kernel I have these lines:
[...]
device miibus # MII bus support
device rl
device ed
options IPFIREWALL #firewall
options IPFIREWALL_VERBOSE #enable logging to syslogd(8)
options IPFIREWALL_VERBOSE_LIMIT=0 #limit verbosity
options IPDIVERT #divert sockets
options DUMMYNET
2003 Jun 11
7
IPFW: combining "divert natd" with "keep-state"
I've been using ipfw for a while to create a router with NAT
and packet filtering, but have never combined it with
stateful filtering, instead using things like "established" to
accept incoming TCP packets which are part of a conversation
initiated from the "inside".
I'd like to move to using keep-state/check-state to get tighter
filtering and also to allow outgoing
2003 May 07
4
IPFW Bandwidth throttling?
I am trying to limit outgoing SMTP traffic to about 14 Mbps and these are
the IPFW rules I am using.
${fwcmd} add pipe 1 tcp from 192.168.0.0/24 to any 25 out via dc0
${fwcmd} pipe 1 config bw 14Mbit/s
I've tried multiple tweaks to the pipe rule and I seem to be missing
something. I only get about half the bandwidth I specify. Is this normal
behavior? Is there something wrong
2003 Apr 25
2
firewalling help/audit
Hi !
First of all, I am sorry if this is not the list for that, but I've been
learning (a little bit...) a way to implement a freeBSD firewall.
So far I came up with a set of rules I would like to show you for commenting.
I am sure there're a lot of errors and/or stupid rules (I am not sure the
rules order is good for what I need) and I would be really pleased if one
could have a look
2003 Dec 23
2
address specified as 1.2.3.4/24{128,35-55,89} Is this Correct ????
The man page gives this example, however, when I attempt to use it, it seems
to block the whole set?
Could someone tell me what's going wrong here please. Thanks heaps..
This works,
${fwcmd} add deny log all from any to 203.1.96.1 in via ${oif}
This blocks the whole IP block, not just the list?
${fwcmd} add deny log all from any to 203.1.96.0/24{2,6-25,27-154,156-19
2004 Sep 01
2
IPFW and icmp
I'm not a master of the internet RFCs, but I do believe icmp messages have
different types.
Now to enable traceroute for IPFW, I might put in a rule like this:
ipfw add pass icmp from any to me
However, how would I make a rule to limit icmp messages to just those used
by traceroute? Can the messages be distinguished as such?
A dynamic rule that exists only for the duration of a traceroute
2007 Dec 13
3
IPFW compiled in kernel: Where is it reading the config?
Hi peeps,
After compiling ipfw into the new 6.2 kernel, and typing "ipfw list",
all I get is:
"65535 deny ip from any to any"
From reading the docs, this might indicate that this is the
default rule. (I am certainly protected this way--but can't
be very productive ;^) )
By the way, when I run "man ipfw" I get nothing. Using this
instead:
2003 Apr 08
7
4.8-STABLE Kernel Panic with dummynet options.
I first met this problem when our (60 students) internetgateway refused to
boot its new kernel, it was a 4.7-RELEASE. Then i loaded the old kernel and
went home to check if my 4.8-STABLE does likewise. And the answer was yes!
Both kernels were GENERIC + these options taken from the dummynet man pages:
options DUMMYNET
options NMBCLUSTERS
options HZ
When i boot the machine
2003 Apr 30
6
how to configure a FreeBSD firewall to pass IPSec?
I have a FreeBSD box acting as a firewall and NAT gateway
I would like to set it up to transparently pass IPSec packets -- I have
an IPSec VPN client running on another machine, connecting to a remote network.
Is there a way to do this? I can't find any hints in the man pages.
2004 Apr 15
2
Policy routing with IPFW
Hi There,
I've been having an issue trying to figure out a way to policy route
outbound packets from a multihomed machine through the proper interface
using IPFW to no avail.
I've tried several different incantations of IPFW fwd/forward
statements, and none of them seem to do the trick.
Basically, I have a host that has multiple Internet connections. This
host is running FreeBSD 4.9
2003 Oct 30
1
Using racoon-negotiated IPSec with ipfw and natd
[ -netters, please Cc me or security@ with replies. ]
I'm running into trouble integrating dynamic racoon-based IPSec into a network
with ipfw and natd. I need to be able to allow VPN access from any address
from authenticated clients. I've got the dynamic VPN working, with racoon
negotiating SAs and installing SPs, but the problem is that I can't tell
whether an incoming packet on
2004 Nov 21
1
[Fwd: Re: Importing into rc.firewal rules]
Hi,
> On Sat, Nov 20, 2004 at 01:32:15PM -0500, Francisco Reyes wrote:
>> I have a grown list of IPs that I am "deny ip from ###.### to any".
Infected machines, hackers, etc..
>>
>> Is there a way to have this list outside of rc.firewall and just read
it in?
>
from man ipfw
LOOKUP TABLES
Lookup tables are useful to handle large sparse address sets, typically
2003 May 19
5
FreeBSD firewall block syn flood attack
Hello,
I current have a FreeBSD 4.8 bridge firewall that sits between 7 servers and
the internet. The servers are being attacked with syn floods and go down
multiple times a day.
The 7 servers belong to a client, who runs redhat.
I am trying to find a way to do some kind of syn flood protection inside the
firewall.
Any suggestions would be greatly appreciated.
--
Ryan James
ryan@mac2.net
2006 Nov 11
5
src/etc/rc.firewall simple ${fw_pass} tcp from any to any established
Hi security@ list,
In my self written, large ipfw rule set, I had something that passed
http to allow me to browse most but not all remote sites. For years
I assumed the few sites I had difficulty with were cases pppoed MTU
!= 1500, from not having installed tcpmssd on my 4.*-RELEASE, but
then running 6.1-RELEASE I realised that wasn't the problem.
http://www.web.de Still failed, &
2003 Aug 05
6
Problems with JAIL in 4.8R
Hi, i've set the outside ip for the jail..It works.. When i try to ssh to
jail'ed system from the main system (in which is created jail) the
connection is successful, but when i try to connect to jailed system from
anywhere else i get this message:
ssh: connect to host IP_NUMBER port 22: Operation timed out
What can be wrong here? How to solve this problem?
2005 May 11
3
icmp problem
hi i have a problem with my icmp, i have a router that
performs nat. i cannot ping to internet hosts from
more than one stations situated behind NAT at once. if
i want to ping from another station i have to stop the
ping that was initiated from the first host, and after
a few seconds i can ping from another station.i've
checked firewll and i have no ipfw rules that could
stop icmp traffic.
2003 Jul 16
1
routing to localhost
For reasons unknown, any connections to localhost -- tcp, icmp, or udp -- are
all originating from my external interface, rl0:
$ telnet localhost 25
Trying ::1...
Trying 127.0.0.1...
telnet: connect to address 127.0.0.1: Can't assign requested address
telnet: Unable to connect to remote host
IPFW log:
Jul 16 12:46:43 octo ipfw: 100 Accept TCP 192.168.1.119:1434 127.0.0.1:25 out
via rl0
2006 Apr 17
3
IPFW Problems?
Hi,
I have a system with a 4.11 Kernel. Unless I'm doing something very
wrong, there seems to be something odd with ipfw.
Take the following rules:
ipfw add 00280 allow tcp from any to any 22 out via bge0 setup keep-
state
ipfw add 00299 deny log all from any to any out via bge0
ipfw add 0430 allow log tcp from any to me 22 in via bge0 setup limit
src-addr 2
ipfw add 00499 deny log