From 7d4cb18f1121718e503b4d3a9d8f524a29f238ff Mon Sep 17 00:00:00 2001
From: yar <yar@FreeBSD.org>
Date: Thu, 7 Feb 2008 11:00:42 +0000
Subject: Add a note that ipfw states do not implicitly match ICMP error
 messages.

---
 sbin/ipfw/ipfw.8 | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'sbin')

diff --git a/sbin/ipfw/ipfw.8 b/sbin/ipfw/ipfw.8
index 2c175ed..67ed262 100644
--- a/sbin/ipfw/ipfw.8
+++ b/sbin/ipfw/ipfw.8
@@ -2711,3 +2711,9 @@ ipfw nat is not compatible with the tcp segmentation offloading
 (TSO). Thus, to reliably nat your network traffic, please disable TSO
 on your NICs using
 .Xr ifconfig 8 .
+.Pp
+ICMP error messages are not implicitly matched by dynamic rules
+for the respective conversations.
+To avoid failures of network error detection and path MTU discovery,
+ICMP error messages may need to be allowed explicitly through static
+rules.
-- 
cgit v1.1