Change Details

``` root@freebsd:/ # ipfw table 10 create type addr valtype mark root@freebsd:/ # ipfw add 20 setmark tablearg icmp from 'table(10)' to any 00020 setmark tablearg icmp from table(10) to any root@freebsd:/ # ipfw show 00020 0 0 setmark tablearg icmp from table(10) to any 00100 7405 1181012 allow ip from any to any 65535 0 0 deny ip from any to any root@freebsd:/ # ipfw table 10 info --- table(10), set(0) --- kindex: 1, type: addr references: 1, valtype: mark algorithm: addr:radix items: 0, size: 296 root@freebsd:/ # ipfw table 10 add 192.168.56.0/24 0x33 added: 192.168.56.0/24 0x33 root@freebsd:/ # ipfw table 10 list 192.168.56.0/24 0x33 root@freebsd:/ # ipfw show 00020 7 4172 setmark tablearg icmp from table(10) to any 00100 12519 1896566 allow ip from any to any 65535 0 0 deny ip from any to any root@freebsd:/ # ipfw add 30 count log ip from 'table(10)' to any mark tablearg 00030 count log ip from table(10) to any mark tablearg root@freebsd:/ # ipfw show 00020 7 4172 setmark tablearg icmp from table(10) to any 00030 0 0 count log ip from table(10) to any mark tablearg 00100 12815 1921782 allow ip from any to any 65535 0 0 deny ip from any to any root@freebsd:/ # root@freebsd:/ # ipfw show 00020 7 4172 setmark tablearg icmp from table(10) to any 00030 0 0 count log ip from table(10) to any mark tablearg 00100 12830 1923470 allow ip from any to any 65535 0 0 deny ip from any to any root@freebsd:/ # sysctl net.inet.ip.fw.verbose=1 net.inet.ip.fw.verbose: 0 -> 1 root@freebsd: # cat /var/log/security Apr 12 12:05:22 freebsd newsyslog[748]: logfile first created Apr 13 11:44:46 freebsd kernel: ipfw: 30 Count ICMP:0.0 192.168.56.101 127.0.0.1 mark:0x33 out via lo0 Apr 13 11:44:46 freebsd kernel: ipfw: 30 Count ICMP:0.0 192.168.56.101 127.0.0.1 mark:0x33 in via lo0 Apr 13 11:45:44 freebsd kernel: ipfw: 30 Count ICMP:3.3 192.168.56.101 192.168.56.100 mark:0x33 out via em1 root@freebsd:/ # ipfw show 00020 10 4936 setmark tablearg icmp from table(10) to any 00030 3 764 count log ip from table(10) to any mark tablearg 00100 13499 1989178 allow ip from any to any 65535 0 0 deny ip from any to any root@freebsd:/ # ```

``` root@freebsd:~ # ipfw show 00100 123 21435 allow ip from any to any 65535 0 0 deny ip from any to any root@freebsd:~ # ipfw add 50 setmark 22 icmp from 0.0.0.0 to 0.0.0.0 00050 setmark 0x16 icmp from 0.0.0.0 to 0.0.0.0 root@freebsd:~ # ipfw add 51 setmark 0x22 icmp from 0.0.0.0 to 0.0.0.0 00051 setmark 0x22 icmp from 0.0.0.0 to 0.0.0.0 root@freebsd:~ # ipfw table 10 create type addr valtype mark root@freebsd:~ # ipfw table 10 info --- table(10), set(0) --- kindex: 1, type: addr references: 0, valtype: mark algorithm: addr:radix items: 0, size: 296 root@freebsd:~ # ipfw add 10 setmark tablearg icmp from 'table(10)' to any via lo0 00010 setmark tablearg icmp from table(10) to any via lo0 root@freebsd:~ # ipfw add 20 count log icmp from 'table(10)' to any mark tablearg 00020 count log icmp from table(10) to any mark tablearg root@freebsd:~ # ipfw show 00010 0 0 setmark tablearg icmp from table(10) to any via lo0 00020 0 0 count log icmp from table(10) to any mark tablearg 00050 0 0 setmark 0x16 icmp from 0.0.0.0 to 0.0.0.0 00051 0 0 setmark 0x22 icmp from 0.0.0.0 to 0.0.0.0 00100 1138 106883 allow ip from any to any 65535 0 0 deny ip from any to any root@freebsd:~ # ifconfig em1 em1: flags=8863<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=481009b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,VLAN_HWFILTER,NOMAP> ether 08:00:27:19:f4:d6 inet6 fe80::a00:27ff:fe19:f4d6%em1 prefixlen 64 scopeid 0x2 inet 192.168.56.101 netmask 0xffffff00 broadcast 192.168.56.255 media: Ethernet autoselect (1000baseT <full-duplex>) status: active nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL> root@freebsd:~ # ipfw table 10 add 192.168.56.0/24 0x44 added: 192.168.56.0/24 0x44 root@freebsd:~ # ipfw table 10 list 192.168.56.0/24 0x44 root@freebsd:~ # sysctl net.inet.ip.fw.verbose=1 net.inet.ip.fw.verbose: 0 -> 1 root@freebsd:~ # ping -c 1 192.168.56.101 PING 192.168.56.101 (192.168.56.101): 56 data bytes 64 bytes from 192.168.56.101: icmp_seq=0 ttl=64 time=0.232 ms --- 192.168.56.101 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 0.232/0.232/0.232/0.000 ms root@freebsd:~ # tail /var/log/security Apr 14 12:16:14 freebsd syslogd: last message repeated 1 times Apr 14 12:27:01 freebsd kernel: ipfw: 20 Count ICMP:0.0 192.168.56.101 127.0.0.1 mark:0x44 out via lo0 Apr 14 12:27:01 freebsd kernel: ipfw: 20 Count ICMP:0.0 192.168.56.101 127.0.0.1 mark:0x44 in via lo0 root@freebsd:~ # ipfw show 00010 2 168 setmark tablearg icmp from table(10) to any via lo0 00020 2 168 count log icmp from table(10) to any mark tablearg 00050 0 0 setmark 0x16 icmp from 0.0.0.0 to 0.0.0.0 00051 0 0 setmark 0x22 icmp from 0.0.0.0 to 0.0.0.0 00100 2104 194583 allow ip from any to any 65535 0 0 deny ip from any to any root@freebsd:~ # ```

``` root@freebsd:/~ # ipfw table 10 create type addr valtype markshow root@freebsd:/ # ipfw add 20 setmark tablearg icm00100 123 21435 allow ip from 'table(10)'any to any 00020 setmark tablearg icm65535 0 0 deny ip from table(10)any to any root@freebsd:/~ # ipfw showadd 50 setmark 22 icmp from 0.0.0.0 to 0.0.0.0 00020 0 00050 setmark tablearg0x16 icmp from table(10)0.0.0.0 to any0.0.0.0 00100 7405 1181012 allow iroot@freebsd:~ # ipfw add 51 setmark 0x22 icmp from any0.0.0.0 to any0.0.0.0 65535 0 0 deny i00051 setmark 0x22 icmp from any0.0.0.0 to any0.0.0.0 root@freebsd:/~ # ipfw table 10 infocreate type addr valtype mark root@freebsd:~ # ipfw table 10 info --- table(10), set(0) --- kindex: 1, type: addr references: 10, valtype: mark algorithm: addr:radix items: 0, size: 296 root@freebsd:/~ # ipfw add 10 setmark table 10 add 192.168.56.0/24 0x33arg icmp from 'table(10)' to any via lo0 added: 192.168.56.0/24 0x3300010 setmark tablearg icmp from table(10) to any via lo0 root@freebsd:/~ # ipfw add 20 count log icmp from 'table 10 list(10)' to any mark tablearg 192.168.56.0/24 0x3300020 count log icmp from table(10) to any mark tablearg root@freebsd:/~ # ipfw show 00020 00010 70 4172 0 setmark tablearg icmp from table(10) to any via lo0 00100 12519 1896566 allow i00020 0 0 count log icmp from anytable(10) to any mark tablearg 65535 00050 0 0 deny i0 setmark 0x16 icmp from any0.0.0.0 to any0.0.0.0 root@freebsd:/ # ipfw add 30 count log i00051 0 0 setmark 0x22 icmp from 'table(10)' to any mark tablearg0.0.0.0 to 0.0.0.0 00030 count log00100 1138 106883 allow ip from table(10)any to any mark tablearg root@freebsd:/ # ipfw show65535 0 0 deny ip from any to any 00020 7 4172 setmark tablearg icmp from table(10) to anyroot@freebsd:~ # ifconfig em1 00030 0 0 count log ip from table(10) to any mark tableargem1: flags=8863<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 00100 12815 1921782 allow ip from any to any options=481009b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,VLAN_HWFILTER,NOMAP> 65535 0 0 deny ip from any to anyether 08:00:27:19:f4:d6 root@freebsd:/ # inet6 fe80::a00:27ff:fe19:f4d6%em1 prefixlen 64 scopeid 0x2 root@freebsd:/ # ipfw show inet 192.168.56.101 netmask 0xffffff00 broadcast 192.168.56.255 00020 7 4172 setmark tablearg icmp from table(10) to any media: Ethernet autoselect (1000baseT <full-duplex>) 00030 0 0 count log ip from table(10) to any mark tablearg status: active 00100 12830 1923470 allow ip from any to any nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL> 65535 0 0 deny ip from any to anyroot@freebsd:~ # ipfw table 10 add 192.168.56.0/24 0x44 root@freebsd:/ # sysctl net.inet.ip.fw.verbose=1added: 192.168.56.0/24 0x44 root@freebsd:~ # ipfw table 10 list 192.168.56.0/24 0x44 root@freebsd:~ # sysctl net.inet.ip.fw.verbose=1 net.inet.ip.fw.verbose: 0 -> 1 root@freebsd:~ # ping -c 1 192.168.56.101 PING 192.168.56.101 (192.168.56.101): 56 data bytes 64 bytes from 192.168.56.101: icmp_seq=0 ttl=64 time=0.232 ms root@freebsd: # cat /var/log/security--- 192.168.56.101 ping statistics --- Apr 12 12:05:22 freebsd newsyslog[748]: logfile first created1 packets transmitted, 1 packets received, 0.0% packet loss Apr 13 11:44:46 freebsd kernel: ipfw: 30 Count ICMP:0.0 192.168.56.101 127.0.0.1 mark:0x33 out via lo0round-trip min/avg/max/stddev = 0.232/0.232/0.232/0.000 ms Apr 13 11:44:46 root@freebsd kernel: ipfw: 30 Count ICMP:0.0 192.168.56.101 127.0.0.1 mark:0x33 in via lo0:~ # tail /var/log/security Apr 13 11:45:44 12:16:14 freebsd kernel: ipfw: 30 Count ICMP:3.3 192.168.56.101 192.168.56.100 mark:0x33 out via em1syslogd: last message repeated 1 times root@Apr 14 12:27:01 freebsd:/ # kernel: ipfw show: 20 Count ICMP:0.0 192.168.56.101 127.0.0.1 mark:0x44 out via lo0 00020 10 4936 setmark tablearg icmp from table(10) to anyApr 14 12:27:01 freebsd kernel: ipfw: 20 Count ICMP:0.0 192.168.56.101 127.0.0.1 mark:0x44 in via lo0 00030 3 764 count log ip from table(10) to any mark tableargroot@freebsd:~ # ipfw show 00100 13499 1989178 allow i00010 2 168 setmark tablearg icmp from anytable(10) to any via lo0 6553500020 0 0 deny i2 168 count log icmp from anytable(10) to any mark tablearg root@freebsd:/ #00050 0 0 setmark 0x16 icmp from 0.0.0.0 to 0.0.0.0 00051 0 0 setmark 0x22 icmp from 0.0.0.0 to 0.0.0.0 00100 2104 194583 allow ip from any to any 65535 0 0 deny ip from any to any root@freebsd:~ # ```