Date: Thu, 15 May 2008 10:45:26 +1200 From: "Mark Pagulayan" <m.pagulayan@auckland.ac.nz> To: <freebsd-pf@freebsd.org> Subject: FreeBSD PF 4.1 Inserts Flags S/SA Automatically to rules Message-ID: <C65291A68BAF57499B18564A1EE4A761370E38@UXCHANGE1.UoA.auckland.ac.nz>
next in thread | raw e-mail | index | archive | help
Hi Guys,=20 =20 OS: FreeBSD 7.0-RELEASE=20 =20 Please correct me if I am wrong that PF 4.1 in FreeBSD 7.0 automatically inserts 'Flags S/SA' to rules?=20 =20 The problem is that when it comes to this rule:=20 =20 pass in quick on $int_if =20 after loading to pf =20 pass in quick on em0 flags S/SA keep state =20 The way I see this is that this rule would be applied to udp traffic as well which will be dropped/blocked because flags only work for tcp and this might be the cause of state-mismatches that I see in the table - =20 state-mismatch 11577272 48.7/s =20 =20 How can we prevent pf from loading the flags S/SA in the rules automatically? =20 Also what is the effect of this on the block rule? =20 'block in log on $ext_if all' 'block return out log on $ext_if all' =20 =20 Cheers,=20 =20 Mark =20
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?C65291A68BAF57499B18564A1EE4A761370E38>