Re: properly ipf config on dom0

[Stephen Borrill <netbsd%precedence.co.uk@localhost>]

On Sat, 19 Dec 2009, Victor Gamov wrote:
> May be wrong maillist but...
>
> I have dom0 with NetBSD and some domU with other OSes.
> external dom0 interface nfe0 bridged to one of domU. IPF configured to check 
> domU IP-address at nfe0 but traffic for domU still not filtered and not 
> logged by IPF.
>
> As I understand traffic comes to nfe0, then driver (?) discover packet 
> addressed to IP-address (or MAC?) owned by domU and send it to domU via 
> bridge without putting it into IPF input queue.
>
> Is it correct?
>
> If so, then I need to recompile kernel with BRIDGE_IPF option?

Yes, you need to have BRIDGE_IPF in your kernel. You also need to have the 
ipf option enabled on your bridge.

--
Stephen