Fwd: IPFilter 4.1.13 on Solaris 8

I have yet to receive any responses to this situation. I surely would
appreciate guidance that anyone may offer. I am hesitant to pursue a
new release, for historically this situation follows uncorrected.


-----Original Message-----
From: boxyzzy@netscape.net
To: ipfilter@coombs.anu.edu.au
Sent: Thu, 4 Jan 2007 8:33 AM
Subject: IPFilter 4.1.13 on Solaris 8

I am attempting to deploy IPFilter 4.1.13 on Solaris 8 systems.ÂÂ*
ÂÂ*
I was unable to deploy IPFilter 4.1.8 due to my trusted computers being
blocked by OOW conditions.ÂÂ*
So, I tried IPFilter 4.1.13. Again OOW conditions prevented deployment.ÂÂ*
Then I rebuilt IPFilter 4.1.13 with (hopefully) no OOW blocking.ÂÂ*
ÂÂ*
Was:ÂÂ*
ip_fil.h:#define FI_OOW 0x0800 /* Out of state window, ... */ÂÂ*
Is:ÂÂ*
ip_fil.h:#define FI_OOW 0x0000 /* Out of state window, ... */ÂÂ*
ÂÂ*
My logic, though arguably faulty, is that I am apparently living okay
with (alledged) OOW conditions without IPFilter.ÂÂ*
I need the protection of IPFilter now.ÂÂ*
ÂÂ*
This modification to IPFilter ran on a test computer for weeks without
any unexpected blocks.ÂÂ*
Then when I attempted to deploy it, IPFilter started blocking my
trusted computers. My intent, as shownÂÂ*
by these config statements, is to NEVER block any traffic from any
computers on my subnetÂÂ*
(123.456.78.01 - 123.456.78.99):ÂÂ*
ÂÂ*
ÂÂ*pass in quick proto tcp from 123.456.78.0/26 to any flags S keepÂÂ*
ÂÂ*pass in quick proto udp from 123.456.78.0/26 to any keep stateÂÂ*
ÂÂ*pass in quick proto tcp from 123.456.78.64/27 to any flags S keep
stateÂÂ*
ÂÂ*pass in quick proto udp from 123.456.78.64/27 to any keep state ÂÂ*
ÂÂ*pass in quick proto tcp from 123.456.78.96/28 to any flags S keep
stateÂÂ*
ÂÂ*pass in quick proto udp from 123.456.78.96/28 to any keep stateÂÂ*
ÂÂ*
However, as shown below from ipmon logs, sometimes traffic from
123.456.78.xx computers is being blocked.ÂÂ*
ÂÂ*
I hope that someone can see what I am missing.ÂÂ*
ÂÂ*
This situation prohibits me from deploying the much needed IPFilter
firewall.ÂÂ*
ÂÂ*
-------------------------------------------------------------------------
ÂÂ*
ÂÂ*
Computer 123.456.78.11:ÂÂ*
29/11/2006 12:16:35.785428 eri0 @0:18 b 123.456.78.59,52740 ->
123.456.78.11,32772 PR tcp len 20 40 -AF INÂÂ*
29/11/2006 12:16:36.713333 eri0 @0:18 b 123.456.78.59,52740 ->
123.456.78.11,32772 PR tcp len 20 40 -AF INÂÂ*
29/11/2006 12:16:38.583342 eri0 @0:18 b 123.456.78.59,52740 ->
123.456.78.11,32772 PR tcp len 20 40 -AF INÂÂ*
29/11/2006 12:16:42.333484 eri0 @0:18 b 123.456.78.59,52740 ->
123.456.78.11,32772 PR tcp len 20 40 -AF INÂÂ*
29/11/2006 12:16:49.834710 eri0 @0:18 b 123.456.78.59,52740 ->
123.456.78.11,32772 PR tcp len 20 40 -AF INÂÂ*
29/11/2006 12:17:04.833742 eri0 @0:18 b 123.456.78.59,52740 ->
123.456.78.11,32772 PR tcp len 20 40 -AF INÂÂ*
ÂÂ*
Computer 123.456.78.43:ÂÂ*
28/11/2006 20:18:07.266794 eri0 @0:18 b 123.456.78.11,33204 ->
123.456.78.43,33287 PR tcp len 20 40 -AF INÂÂ*
28/11/2006 20:18:10.632686 eri0 @0:18 b 123.456.78.11,33204 ->
123.456.78.43,33287 PR tcp len 20 40 -AF INÂÂ*
28/11/2006 20:18:17.382736 eri0 @0:18 b 123.456.78.11,33204 ->
123.456.78.43,33287 PR tcp len 20 40 -AF INÂÂ*
ÂÂ*
.... records deleted ...ÂÂ*
ÂÂ*
29/11/2006 07:54:58.685624 eri0 @0:18 b 123.456.78.47,40404 ->
123.456.78.43,33287 PR tcp len 20 40 -AF INÂÂ*
29/11/2006 07:55:03.530294 eri0 @0:18 b 123.456.78.47,40404 ->
123.456.78.43,33287 PR tcp len 20 40 -AF INÂÂ*
29/11/2006 07:55:13.240332 eri0 @0:18 b 123.456.78.47,40404 ->
123.456.78.43,33287 PR tcp len 20 40 -AF INÂÂ*
29/11/2006 07:55:32.661388 eri0 @0:18 b 123.456.78.47,40404 ->
123.456.78.43,33287 PR tcp len 20 40 -AF INÂÂ*
ÂÂ*
.... records deleted ...ÂÂ*
ÂÂ*
29/11/2006 08:18:55.785726 eri0 @0:18 b 123.456.78.68,39750 ->
123.456.78.43,33287 PR tcp len 20 40 -AF INÂÂ*
29/11/2006 08:19:00.637141 eri0 @0:18 b 123.456.78.68,39750 ->
123.456.78.43,33287 PR tcp len 20 40 -AF INÂÂ*
29/11/2006 08:19:10.367237 eri0 @0:18 b 123.456.78.68,39750 ->
123.456.78.43,33287 PR tcp len 20 40 -AF INÂÂ*
29/11/2006 08:19:29.827933 eri0 @0:18 b 123.456.78.68,39750 ->
123.456.78.43,33287 PR tcp len 20 40 -AF INÂÂ*
ÂÂ*
.... records deleted ...ÂÂ*
ÂÂ*
29/11/2006 09:00:15.181563 eri0 @0:18 b 123.456.78.76,38799 ->
123.456.78.43,33287 PR tcp len 20 40 -AF INÂÂ*
29/11/2006 09:00:20.037385 eri0 @0:18 b 123.456.78.76,38799 ->
123.456.78.43,33287 PR tcp len 20 40 -AF INÂÂ*
29/11/2006 09:00:29.767323 eri0 @0:18 b 123.456.78.76,38799 ->
123.456.78.43,33287 PR tcp len 20 40 -AF INÂÂ*
29/11/2006 09:00:49.229308 eri0 @0:18 b 123.456.78.76,38799 ->
123.456.78.43,33287 PR tcp len 20 40 -AF INÂÂ*
ÂÂ*
.... records deleted ...ÂÂ*
ÂÂ*


__________________________________________________ ______________________
Check Out the new free AIM(R) Mail -- 2 GB of storage and
industry-leading spam and email virus protection.
=0