diff options
| author | Philipp Buehler <pb@cvs.openbsd.org> | 2003-06-11 17:03:10 +0000 |
|---|---|---|
| committer | Philipp Buehler <pb@cvs.openbsd.org> | 2003-06-11 17:03:10 +0000 |
| commit | 268bcc476d57b2b9617025eb6e3df88d03877431 (patch) | |
| tree | c96838a607685e0a28d8b511d9a278fc8f5b6a03 /share/man/man4 | |
| parent | 8807fce6bb1f537975c3edd1465e6dc58cc14700 (diff) | |
document that is is unsupported to use return-rst/icmp or synproxy
on bridging firewalls
henning@ ok, spelling fixes from jmc@
Diffstat (limited to 'share/man/man4')
| -rw-r--r-- | share/man/man4/bridge.4 | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/share/man/man4/bridge.4 b/share/man/man4/bridge.4 index 4480515699a..08c65045a39 100644 --- a/share/man/man4/bridge.4 +++ b/share/man/man4/bridge.4 @@ -1,4 +1,4 @@ -.\" $OpenBSD: bridge.4,v 1.50 2003/06/06 10:29:41 jmc Exp $ +.\" $OpenBSD: bridge.4,v 1.51 2003/06/11 17:03:09 pb Exp $ .\" .\" Copyright (c) 1999-2001 Jason L. Wright (jason@thought.net) .\" All rights reserved. @@ -584,6 +584,16 @@ and destination addresses reversed between interfaces, two state entries (one for each direction) are required when all interfaces are filtered statefully. .Pp +It is unsupported to use filter rules which would generate packets. +This applies to rules with +.Ar return , +.Ar return-rst , +.Ar return-icmp , +.Ar return-icmp6 +or +.Ar synproxy +defined. +.Pp If an IP packet is too large for the outgoing interface the bridge will perform IP fragmentation. This can happen when bridge members |