From owner-FreeBSD-net-jp@jp.freebsd.org  Tue Apr  4 21:37:09 2000
Received: (from daemon@localhost)
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) id VAA65305;
	Tue, 4 Apr 2000 21:37:09 +0900 (JST)
	(envelope-from owner-FreeBSD-net-jp@jp.FreeBSD.org)
Received: from hitiij.hitachi.co.jp (root@hitiij.hitachi.co.jp [133.145.224.3])
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) with ESMTP id VAA65300
	for <freebsd-net-jp@jp.freebsd.org>; Tue, 4 Apr 2000 21:37:08 +0900 (JST)
	(envelope-from hideaki@hitachi-densa.co.jp)
Received: from densa.hitachi.co.jp by hitiij.hitachi.co.jp (8.9.3/3.7W-hitiij) id VAA29496; Tue, 4 Apr 2000 21:37:08 +0900 (JST)
Received: from densa.hitachi.co.jp (hiwall-ssn.densa.hitachi.co.jp [202.19.0.33])
	by psext.densa.hitachi.co.jp (8.8.8/3.7W/19990413a) with ESMTP id VAA18149
	for <freebsd-net-jp@jp.freebsd.org>; Tue, 4 Apr 2000 21:37:08 +0900 (JST)
Received: from ns2.hitachi-densa.co.jp ([202.19.3.231])
	by mail.hitachi-densa.co.jp (8.9.3/3.7W/19991228a) with ESMTP id VAA16168
	for <freebsd-net-jp@jp.freebsd.org>; Tue, 4 Apr 2000 21:40:28 +0900 (JST)
Received: from pc147075.hes.hitachi-densa.co.jp ([10.4.172.56]) by ns2.hitachi-densa.co.jp (8.7.5+2.6Wbeta7/3.5Wbeta96082620) with SMTP id VAA22753 for <freebsd-net-jp@jp.freebsd.org>; Tue, 4 Apr 2000 21:37:06 +0900 (JST)
Message-Id: <200004041235.AA00013@pc147075.hes.hitachi-densa.co.jp>
From: Hideaki Nakajima <hideaki@hitachi-densa.co.jp>
Date: Tue, 04 Apr 2000 21:35:49 +0900
To: freebsd-net-jp@jp.freebsd.org
MIME-Version: 1.0
X-Mailer: AL-Mail32 Version 1.10
Content-Type: text/plain; charset=iso-2022-jp
Reply-To: FreeBSD-net-jp@jp.freebsd.org
Precedence: list
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+000315
X-Sequence: FreeBSD-net-jp 2421
Subject: [FreeBSD-net-jp 2421] bridge_ipfw =?ISO-2022-JP?B?GyRCJEsbKEI=?=
 =?ISO-2022-JP?B?GyRCJEQkJCRGGyhC?= 
Errors-To: owner-FreeBSD-net-jp@jp.freebsd.org
Sender: owner-FreeBSD-net-jp@jp.freebsd.org
X-Originator: hideaki@hitachi-densa.co.jp

$B$O$8$a$^$7$FCfEh(B@$B$G$s$5$G$9!#(B
bridge_ipfw$B$K$D$$$F0J2<$N9=@.$G?'!9$H%F%9%H$7$F$$$^$9$,!"$&$^$/F0$$$F$/$l$:(B
$B:$$C$F$$$^$9!#(B
                ipfw                                 
             +-------+ ed2                        ed0 $B$H(B ed1 $B$OF10l(Bsubnet
  router ----+ hostA +-----------------+-------+  ed2 $B$O(B $BJL(Bsubnet
         ed0 +---+---+    NAT      +---+---+      
                 | ed1             | hostC |	if$B$N>uBV(B
             +---+-----+-------+   +---+---+	ed0,ed2 up ed1 $B$O$=$N$^$^(B
                       |
                   +---+---+		hostA	FreeBSD 3.4-Release
                   | hostB |		hostB	TurboLinux Server
                   +-------+		hostC	Windows95
ping$B$G3NG'$9$k$H(B
1. sysctl -w net.link.ether.bridge=1
   sysctl -w net.link.ether.bridge_ipfw=0
   natd=NO (ed0-ed1$B4V$N(Bbridge) $B$N>l9g(B
	router	<-> hostA OK
	router	<-> hostB OK

2. sysctl -w net.link.ether.bridge=1
   sysctl -w net.link.ether.bridge_ipfw=1
   natd=NO $B$N>l9g(B
	router	<-> hostA OK
	router	<-> hostB NG
  $B$?$@$7!"(BhostA$B>e$N(Barp$B%-%c%C%7%e(B(hostB)$B$,;D$C$F$$$k>l9g$O(B router - hostB$B4V(B
  $B$NDL?.$,2DG=!#%-%c%C%7%e$,L5$$>uBV$N>l9g!"(B hostB$B>e$G(Btcpdump$B$G%b%K%?$9$k$H(B
  broadcast$B$O(Bbridge$B$5$l$F$$$^$9$,(Barp$B%j%/%(%9%H(B(hostB -> router)$B$,(Brouter $B$X(B
  $BFO$-$^$;$s!#$^$?!"(Brouter$B$+$i(BhostB$B$X$N(Barp$B%j%/%(%9%H$b(Bbridge$B$5$l$^$;$s!#(B

3. $B9`(B2$B$N>uBV$G(Bnatd$B$rM-8z$K$7$F(Bping(router -> hostB)$B$r<B9T$9$k$H(Bpanic$B$GDd;_(B
  $B$7$F$7$^$$$^$9!#(B

$B9`(B2$B$G$O!"(Bipfw$B$N(BIP$B%Q%1%C%H$K4X$9$k%k!<%k$OLdBj$J$$$H;W$o$l$^$9!#$7$+$7(Barp
$B%j%/%(%9%H$,(Bbridge$B$5$l$J$$$H:G=i$NDL?.$,3NN)=PMh$J$$$?$a!"<B<ADL?.IT2DG=$J(B
$B>uBV$G$9!#(Bdummynet(4) ipfw(8) $BEy$r8+$^$7$?$,(Barp$B%j%/%(%9%H$rDL$9@_Dj$,8+$D(B
$B$+$j$^$;$s!#(Bproxyarp$B$rM-8z$K$7$F$_$^$7$?$,JQ$o$j$^$;$s$G$7$?!#(B
$B:G=*E*$K$O9`(B3 $B$N>uBV$G(BhostC -> router $B$X$O%"%I%l%9JQ49!"(BhostA -> hostB $B$O(B
$B%Q%1%C%H%U%#%k%?%j%s%0$r9M$($F$$$^$9!#(Bed0,ed1$B$N%M%C%H%o!<%/$rJ,3d$J$7$G(B
$BL\E*$rC#@.$9$k$3$H$OIT2DG=$G$7$g$&$+(B?
$B$^$?!"(Bnatd$B$rM-8z(B($B%k!<%k$b:F%m!<%I(B)$B$K$7$?;~$K(Bpanic$B$GDd;_$7$F$7$^$&$N$bIT0B(B
$B$G$9!#(Bipfw pipe add $BEy;n$7$F$_$^$7$?$,!"%@%a$G$7$?!#(B

$B%3%s%U%#%0%l!<%7%g%s$O0J2<$N$h$&$K$7$F$$$^$9!#(B
/etc/defaults/rc.conf $B$NFbMF(B($BH4?h(B)
firewall_enable="YES"
firewall_script="/etc/rc.firewall"  <- $B%k!<%k$O=q$-49$($F$$$^$;$s!#(B
firewall_type="open"
firewall_quiet="NO"
natd_program="/sbin/natd"
natd_enable="NO"
natd_interface="ed0"
natd_flags=""
network_interfaces="auto"
ifconfig_lo0="inet 127.0.0.1"
ifconfig_ed0="inet 210.xxx.xxx.xxx netmask 255.255.255.240"
#ifconfig_ed1=
ifconfig_ed2="inet 192.168.0.1 netmask 255.255.255.0"

kernel option $B$NFbMF(B($BH4?h(B)
options         IPFIREWALL
options         IPFIREWALL_VERBOSE
options         IPFIREWALL_FORWARD
options         "IPFIREWALL_VERBOSE_LIMIT=100"
#options         IPFIREWALL_DEFAULT_TO_ACCEPT
options         IPDIVERT
options         DUMMYNET
options         BRIDGE

$B$h$m$7$/$*4j$$$$$?$7$^$9!#(B

 ------
$B!!CfEh!!=(L@!!(BHideaki Nakajima
$B!!(BE-mail: hideaki@hitachi-densa.co.jp
  $BF|N)EE;R%5!<%S%9(B($B3t(B) $BEl5~;Y<R(B $BBh(B8$B%5!<%S%9It(B $BBh(B3$B%0%k!<%W(B
  Phone +81-3-3256-0840 Fax +81-3-3256-0670
