From owner-freebsd-pf@FreeBSD.ORG Mon Aug 8 14:54:30 2005 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 52B2316A420 for ; Mon, 8 Aug 2005 14:54:30 +0000 (GMT) (envelope-from dhartmei@insomnia.benzedrine.cx) Received: from insomnia.benzedrine.cx (insomnia.benzedrine.cx [62.65.145.30]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5FB0043D46 for ; Mon, 8 Aug 2005 14:54:29 +0000 (GMT) (envelope-from dhartmei@insomnia.benzedrine.cx) Received: from insomnia.benzedrine.cx (dhartmei@localhost [127.0.0.1]) by insomnia.benzedrine.cx (8.13.4/8.12.11) with ESMTP id j78EsPoL029654 (version=TLSv1/SSLv3 cipher=DHE-DSS-AES256-SHA bits=256 verify=NO); Mon, 8 Aug 2005 16:54:26 +0200 (MEST) Received: (from dhartmei@localhost) by insomnia.benzedrine.cx (8.13.4/8.12.10/Submit) id j78EsPHi025327; Mon, 8 Aug 2005 16:54:25 +0200 (MEST) Date: Mon, 8 Aug 2005 16:54:25 +0200 From: Daniel Hartmeier To: Sergey Lapin Message-ID: <20050808145425.GI11104@insomnia.benzedrine.cx> References: <48239d390508040958265ce62@mail.gmail.com> <48239d3905080504297b3ebc89@mail.gmail.com> <200508060411.05482.max@love2party.net> <48239d390508080452270c8d10@mail.gmail.com> <42F7502C.4070003@tirloni.org> <48239d3905080807182fef6a5b@mail.gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <48239d3905080807182fef6a5b@mail.gmail.com> User-Agent: Mutt/1.5.6i Cc: freebsd-pf@freebsd.org Subject: Re: Fwd: pf problems X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Aug 2005 14:54:30 -0000 On Mon, Aug 08, 2005 at 06:18:28PM +0400, Sergey Lapin wrote: > It does not help. Actually, it looks like pf does not have control > over outgoing packets produced by pf itself. I can not neither block > nor reroute these packets. I checked this very easily - I created a > rule > > block out log quick from SOME_OUTSIDE_HOST/32 to any > block out log quick from any to SOME_OUTSIDE_HOST/32 > > and made it very first rules of the firewall. Needless to say, when I > tried to telnet to router port 9999 from SOME_OUTSIDE_HOST, tcpdump on > the pflog0 device got incoming SYN but did not show RST. From the > other hand, tcpdump on the default gateway interface shown outgoing > RST. Again, from this I conclude that pf-generated packets (RST/ICMP) > are not subject for ruleset processing. No, they are not. You can try a 6.0 RC containing a newer version of pf which sends TCP RSTs (generated by 'return-rst') back out through the interface the blocked packet came in through. Alterantively, use multiple filtering devices, one in front of each uplink. Daniel