Date: Wed, 14 May 2008 16:13:51 -0700 From: "Kian Mohageri" <kian.mohageri@gmail.com> To: "Mark Pagulayan" <m.pagulayan@auckland.ac.nz> Cc: freebsd-pf@freebsd.org Subject: Re: FreeBSD PF 4.1 Inserts Flags S/SA Automatically to rules Message-ID: <fee88ee40805141613k685c1536w9fc72e88aaa9f746@mail.gmail.com> In-Reply-To: <C65291A68BAF57499B18564A1EE4A761370E38@UXCHANGE1.UoA.auckland.ac.nz> References: <C65291A68BAF57499B18564A1EE4A761370E38@UXCHANGE1.UoA.auckland.ac.nz>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, May 14, 2008 at 3:45 PM, Mark Pagulayan <m.pagulayan@auckland.ac.nz> wrote: > Hi Guys, > > > > OS: FreeBSD 7.0-RELEASE > > > > Please correct me if I am wrong that PF 4.1 in FreeBSD 7.0 automatically > inserts 'Flags S/SA' to rules? > > It does... actually 'flags S/SA keep state'. > > The problem is that when it comes to this rule: > > > > pass in quick on $int_if > > > > after loading to pf > > > > pass in quick on em0 flags S/SA keep state > > > > The way I see this is that this rule would be applied to udp traffic as > well which will be dropped/blocked because flags only work for tcp and > this might be the cause of state-mismatches that I see in the table - > 'flags S/SA keep state' will work OK for UDP too. Only the 'keep state' part will be applied to UDP, since no flags are involved. > state-mismatch 11577272 48.7/s > Could be caused by reloading your ruleset to include 'keep state' mid-connections, I think. PF won't be aware of where the state is (especially true if you're using TCP window scaling), so it will fail after a while and you'll see state mismatches. > > > > > How can we prevent pf from loading the flags S/SA in the rules > automatically? > Use 'no state' after the rule if it's necessary. But keep in mind stateful tracking is faster. E.g.: pass in on $ext_if no state > > > Also what is the effect of this on the block rule? > > > > 'block in log on $ext_if all' > > 'block return out log on $ext_if all' > > Not sure what you mean, but read pf.conf(5) man page. -Kian
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?fee88ee40805141613k685c1536w9fc72e88aaa9f746>