UDP keep frags does not work

This is a discussion on UDP keep frags does not work within the IPFilter forums, part of the System Security and Security Related category; In ipf 3.4.20 and 3.4.35 (and thus probably all in between) on Solaris 7_x86, "keep ...


Go Back   Usenet Forums > System Security and Security Related > IPFilter

FAQ Members List Calendar Search Today's Posts Mark Forums Read
  #1 (permalink)  
Old 12-13-2004
Hans Werner Strube
 
Posts: n/a
Default UDP keep frags does not work

In ipf 3.4.20 and 3.4.35 (and thus probably all in between) on Solaris 7_x86,
"keep frags" has no effect on either interface of a two-interface firewall
for UDP protocol. Rules as far as relevant (elxl1 is the outer interface,
elxl0 the inner one):

block in log quick on elxl1 all head 100
block out log quick on elxl1 all head 150
block in log quick on elxl0 all head 200
pass in quick proto udp from any to !FIREWALL keep state keep frags group 200
block out log quick on elxl0 all head 250

When an NFS connection over UDP is opened to an external (read-only) NFS server
with rsize=8192, the answer of read operations is, of course, always fragmented
when the packets exceed 1500 bytes. These fragments are not let through by
the outer interface. If I open the outer interface specifically for them,
they are rejected by the inner interface. Thus I have to use the following
workaround:

block in log quick on elxl1 all head 100
pass in quick proto udp from NFSSERVER to !FIREWALL with frag group 100
block out log quick on elxl1 all head 150
block in log quick on elxl0 all head 200
pass in quick proto udp from any to !FIREWALL keep state group 200
block out log quick on elxl0 all head 250
pass out quick proto udp from NFSSERVER to any with frag group 250

Is this a bug or a feature? BTW, the same behaviour occurs for ICMP ECHO
(ping with large data size).
Reply With Quote
Reply
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are Off
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT +1. The time now is 11:00 AM.


Powered by vBulletin® Version 3.7.3
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.0.0