From owner-freebsd-net@FreeBSD.ORG Fri Nov 9 00:00:16 2007 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 6BE0116A4D5 for ; Fri, 9 Nov 2007 00:00:16 +0000 (UTC) (envelope-from max@love2party.net) Received: from moutng.kundenserver.de (moutng.kundenserver.de [212.227.126.186]) by mx1.freebsd.org (Postfix) with ESMTP id F3C7813C48E for ; Fri, 9 Nov 2007 00:00:15 +0000 (UTC) (envelope-from max@love2party.net) Received: from amd64.laiers.local (dslb-088-066-048-233.pools.arcor-ip.net [88.66.48.233]) by mrelayeu.kundenserver.de (node=mrelayeu3) with ESMTP (Nemesis) id 0MKxQS-1IqHHw1ECJ-0006kY; Fri, 09 Nov 2007 00:59:57 +0100 From: Max Laier Organization: FreeBSD To: Dag-Erling =?iso-8859-1?q?Sm=F8rgrav?= Date: Fri, 9 Nov 2007 00:59:46 +0100 User-Agent: KMail/1.9.7 References: <86zlxoblmj.fsf@ds4.des.no> <200711082259.46222.max@love2party.net> <86fxzgl63d.fsf@ds4.des.no> In-Reply-To: <86fxzgl63d.fsf@ds4.des.no> X-Face: ,,8R(x[kmU]tKN@>gtH1yQE4aslGdu+2]; R]*pL,U>^H?)gW@49@wdJ`H<=?utf-8?q?=25=7D*=5FBD=0A=09U=5For=3D=5CmOZf764=26nYj=3DJYbR1PW0ud?=>|!~,,CPC.1-D$FG@0h3#'5"k{V]a~.<=?utf-8?q?mZ=7D44=23Se=7Em=0A=09Fe=7E=5C=5DX5B=5D=5Fxj?=(ykz9QKMw_l0C2AQ]}Ym8)fU MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart2660290.oMDQ0VjJXA"; protocol="application/pgp-signature"; micalg=pgp-sha1 Content-Transfer-Encoding: 7bit Message-Id: <200711090059.54990.max@love2party.net> X-Provags-ID: V01U2FsdGVkX1/FhWCd5u7iJiaOXU3g8wrO0PccT/trfq2/uK0 0kRuimocgLnMzxcHNbdse9IN/oXvYSMYClFKLYTC+BI3rTWrIm lXGeYlnd1C1YG8+O86+Y1hTP42znQAwR6QlIuwfW/s= Cc: freebsd-net@freebsd.org, dhartmei@freebsd.org Subject: Re: pf misfeature X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Nov 2007 00:00:16 -0000 --nextPart2660290.oMDQ0VjJXA Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Thursday 08 November 2007, Dag-Erling Sm=C3=B8rgrav wrote: > Max Laier writes: > > On Thursday 08 November 2007, Dag-Erling Sm=C3=B8rgrav wrote: > > > With "pass on $eth from $lan to $lan", NFS doesn't work. With "pass = on > > > $eth inet proto { tcp, udp } from $lan to $lan", it does. > > thinking about it, this could be a strange interaction with skip > > steps. Could you provide "pfctl -gvsr" with either rule(s)? In > > private mail if you prefer. >=20 > With (NFS works): >=20 > @0 block return quick inet6 all > [ Skip steps: i=3D3 d=3D3 p=3D2 sa=3D4 sp=3Dend da=3D3 dp=3D3 ] > [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] > [ Evaluations: 143 Packets: 0 Bytes: 0 States: = 0 ] > @1 block return log all > [ Skip steps: i=3D3 d=3D3 sa=3D4 sp=3Dend da=3D3 dp=3D3 ] > [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] > [ Evaluations: 143 Packets: 0 Bytes: 0 States: = 0 ] > @2 pass inet proto icmp all icmp-type echoreq keep state > [ Skip steps: f=3Dend sa=3D4 sp=3Dend ] > [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] > [ Evaluations: 143 Packets: 0 Bytes: 0 States: = 0 ] > @3 pass in on sk0 inet proto tcp from any to (sk0:1) port =3D ssh flags S= /SA keep state > [ Skip steps: i=3Dend f=3Dend p=3D5 sp=3Dend ] > [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] > [ Evaluations: 143 Packets: 0 Bytes: 0 States: = 0 ] > @4 pass on sk0 inet proto tcp from (sk0:network:1) to (sk0:network:1) fla= gs S/SA keep state > [ Skip steps: i=3Dend d=3D6 f=3Dend sa=3D6 sp=3Dend da=3D6 dp=3Dend ] > [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] > [ Evaluations: 61 Packets: 1386 Bytes: 158934 States: = 2 ] > @5 pass on sk0 inet proto udp from (sk0:network:1) to (sk0:network:1) kee= p state > [ Skip steps: i=3Dend f=3Dend sp=3Dend dp=3Dend ] > [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] > [ Evaluations: 143 Packets: 267 Bytes: 47931 States: = 3 ] > @6 pass out on sk0 inet proto tcp from (sk0:1) to ! (sk0:network:1) flags= S/SA keep state > [ Skip steps: i=3Dend d=3Dend f=3Dend sa=3Dend sp=3Dend da=3Dend dp=3De= nd ] > [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] > [ Evaluations: 143 Packets: 0 Bytes: 0 States: = 0 ] > @7 pass out on sk0 inet proto udp from (sk0:1) to ! (sk0:network:1) keep = state > [ Skip steps: i=3Dend d=3Dend f=3Dend p=3Dend sa=3Dend sp=3Dend da=3Den= d dp=3Dend ] > [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] > [ Evaluations: 52 Packets: 0 Bytes: 0 States: = 0 ] >=20 > Without (NFS doesn't work): >=20 > @0 block return quick inet6 all > [ Skip steps: i=3D3 d=3D3 p=3D2 sa=3D4 sp=3Dend da=3D3 dp=3D3 ] > [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] > [ Evaluations: 18 Packets: 0 Bytes: 0 States: = 0 ] > @1 block return log all > [ Skip steps: i=3D3 d=3D3 sa=3D4 sp=3Dend da=3D3 dp=3D3 ] > [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] > [ Evaluations: 18 Packets: 4 Bytes: 5784 States: = 0 ] > @2 pass inet proto icmp all icmp-type echoreq keep state > [ Skip steps: f=3D4 sa=3D4 sp=3Dend ] > [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] > [ Evaluations: 18 Packets: 0 Bytes: 0 States: = 0 ] > @3 pass in on sk0 inet proto tcp from any to (sk0:1) port =3D ssh flags S= /SA keep state > [ Skip steps: i=3Dend sp=3Dend ] > [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] > [ Evaluations: 18 Packets: 69 Bytes: 9760 States: = 1 ] > @4 pass on sk0 from (sk0:network:1) to (sk0:network:1) flags S/SA keep st= ate > [ Skip steps: i=3Dend f=3Dend p=3Dend sp=3Dend dp=3Dend ] > [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] > [ Evaluations: 18 Packets: 30 Bytes: 3443 States: = 13 ] > @5 pass out on sk0 from (sk0:1) to ! (sk0:network:1) flags S/SA keep state > [ Skip steps: i=3Dend d=3Dend f=3Dend p=3Dend sa=3Dend sp=3Dend da=3Den= d dp=3Dend ] > [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] > [ Evaluations: 18 Packets: 0 Bytes: 0 States: = 0 ] No, I don't see why these two should behave differently, but you should add a "scrub in on sk0" in any case. Daniel, do you spot anything strange with these skip steps (or otherwise)? =2D-=20 /"\ Best regards, | mlaier@freebsd.org \ / Max Laier | ICQ #67774661 X http://pf4freebsd.love2party.net/ | mlaier@EFnet / \ ASCII Ribbon Campaign | Against HTML Mail and News --nextPart2660290.oMDQ0VjJXA Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4 (FreeBSD) iD8DBQBHM6L6XyyEoT62BG0RAr0wAJ9a0i3IkHtUln8gRr4rvnUA5R9V6wCfQO7f 85T5XWEDnMK5fbO/eg/2H4A= =egnl -----END PGP SIGNATURE----- --nextPart2660290.oMDQ0VjJXA--