lkml.org 
[lkml]   [1999]   [Feb]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectInterface matching of firewall forwarding rules

We have just noticed something curious when examining the
CONFIG_IP_FIREWALL_VERBOSE outputs of onw of our firewalls.

It seems that packets rejected by forwarding rules are done so
based on their outgoing interface, rather than the incoming one.

The behaviour seems to apply to kernel 2.0.36 and 2.2.1pre4.

This seems counter-intuitive, I would expect the firewall code to
match the interface that the packet was received on.

The docs for ipchains and ipfwadm are ambiguous, stating that
matches occur based upon the "name of an interface via which a
packet is received, or via which is packet is going to be sent."

Can anyone offer a rationale for this behaviour?

Thanks,
Damien Miller


--
| "Bombay is 250ms from New York in the new world order" - Alan Cox
| Damien Miller - http://www.ilogic.com.au/~dmiller
| Email: dmiller@ilogic.com.au (home) -or- damien@ibs.com.au (work)


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:50    [W:0.033 / U:3.676 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site