IPFW and if_bridge

jrt03 · #1 June 12th, 2011, 06:43

Hey guys,

I've currently got an inline bridge setup where traffic flows like so:

Code:

 em0 --> bridge0 --> em1

I'm using ipfw to only allow certain traffic through, but tcpdump shows incoming traffic that I explicitly deny in ipfw making it to the bridge0 interface and then being blocked. I was under the impression, the traffic would be blocked at em0.

I've got a custom program that uses libpcap listening on the bridge0 interface and I would rather not have to deal with the blocked traffic. Are there any sysctl knobs I can tweak such that traffic doesn't hit bridge0 before being evaluated against the firewall ruleset?

Here are my relevant sysctl settings:

Code:

net.link.bridge.ipfw: 1 (I'm using Dummynet as well)
net.link.bridge.inherit_mac: 0
net.link.bridge.log_stp: 0
net.link.bridge.pfil_local_phys: 0
net.link.bridge.pfil_member: 0
net.link.bridge.pfil_bridge: 0
net.link.bridge.ipfw_arp: 0
net.link.bridge.pfil_onlyip: 0

Thanks in advance!

jrt03 · #2 June 14th, 2011, 16:23

Can I provide any more information regarding my issue? Please let me know if there's something that is unclear

jrt03 · #3 August 16th, 2011, 21:03

After taking some time to focus on some different areas, I'm running up against this problem again with no solution. Does anyone have any input on the issue described in my original post?

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
if_bridge - stripping off 802.1q vlan tags	elof	Networking	8	February 18th, 2011 14:26
if_bridge stops working after a while	nicblais	Networking	16	October 26th, 2010 07:54
FreeBSD 8 if_bridge does not pass 802.1q vlans	tea	Networking	6	March 11th, 2010 12:09
IPv6 & if_bridge	jimmyn	Firewalls	0	February 21st, 2010 14:32
if_bridge performance	michelem	Networking	1	February 8th, 2009 18:08