From owner-freebsd-questions@FreeBSD.ORG  Fri Jun  9 10:40:42 2006
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
X-Original-To: freebsd-questions@freebsd.org
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 1852416A41A
	for <freebsd-questions@freebsd.org>;
	Fri,  9 Jun 2006 10:40:42 +0000 (UTC)
	(envelope-from norgaard@locolomo.org)
Received: from strange.locolomo.org (59.Red-81-33-11.staticIP.rima-tde.net
	[81.33.11.59]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8AB9743D72
	for <freebsd-questions@freebsd.org>;
	Fri,  9 Jun 2006 10:40:41 +0000 (GMT)
	(envelope-from norgaard@locolomo.org)
Received: from [192.168.7.193] (68.Red-80-34-55.staticIP.rima-tde.net
	[80.34.55.68])
	by strange.locolomo.org (Postfix) with ESMTP id E8B632E024;
	Fri,  9 Jun 2006 12:40:38 +0200 (CEST)
Message-ID: <4489501F.7070501@locolomo.org>
Date: Fri, 09 Jun 2006 12:40:31 +0200
From: Erik Norgaard <norgaard@locolomo.org>
User-Agent: Thunderbird 1.5.0.4 (Windows/20060516)
MIME-Version: 1.0
To: Pat Maddox <pergesu@gmail.com>
References: <810a540e0606082221n488bf220q3846d9c79b47e1ad@mail.gmail.com>
In-Reply-To: <810a540e0606082221n488bf220q3846d9c79b47e1ad@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: FreeBSD Questions <freebsd-questions@freebsd.org>
Subject: Re: Need some help with PF rule letting two machines access each
 other
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 09 Jun 2006 10:40:42 -0000

Pat Maddox wrote:
> 12.34.56.78 runs a server on port 1234
> 87.65.43.21 should connect to this
> 
> Both of them have PF rulesets that block off most traffic, keeping
> open the publically available ports I need open.  In this case though,
> any traffic over this port should only be between these two machines.
> I've tried to set this up, but I keep getting operation not permitted,
> connection refused, and connection reset by peer errors.  Thanks for
> any info.

It's quite difficult to tell which rule catches your packets without the 
ruleset. Try this:

1) Add "log" to all block rules
2) Check you have keep state in pass rules
3) Check you have quick in your pass rules

If you have a default block policy, then you should generally have quick 
in pass rules or you might have packets marked for passing being caught 
later by a block rule.

I generally prefer having the default policy at top without quick, and 
then set quick on rules taking an explicit action.

Cheers, Erik