Andre Oppermann wrote: > > > there are still other things freebsd lacks. such as uRPF that > > _SERVICE_PROVIDER_ > > can use. ipfw2 has verrevpath but all it does from what i know is strict > > uRPF > > only. service providers like myself, if we were to use freebsd boxen to > > run our > > network, i am not spending money on a router that doesn't do loose-check > > uRPF. > > this sounds like something linux does too but i refuse to use that :P > > That is pretty easy to implement. I should have it by Friday at latest, > depends on when exactly I find time for it. > > ip verify unicast source reachable-via [any|ifn] > > The ipfw2 command would look like this: ... versrcreach [fxp0]
Here you go: http://www.nrg4u.com/freebsd/ipfw_versrcreach.diff This one implements the standard functionality, the definition of an interface through which it has to be reachable is not (yet) supported. Using this option only makes sense when you don't have a default route which naturally always matches. So this is useful for machines acting as routers with a default-free view of the entire Internet as common when running a BGP daemon (Zebra/Quagga or OpenBSD bgpd). One useful way of enabling it globally on a router looks like this: ipfw add xxxx deny ip from any to any not versrcreach or for an individual interface only: ipfw add xxxx deny ip from any to any not versrcreach recv fxp0 I'd like to get some feedback (and a man page draft) before I commit it to -CURRENT. -- Andre _______________________________________________ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "[EMAIL PROTECTED]"
