From owner-freebsd-pf@FreeBSD.ORG  Thu Jun 16 19:38:53 2005
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
X-Original-To: freebsd-pf@freebsd.org
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id DAB8716A41C
	for <freebsd-pf@freebsd.org>; Thu, 16 Jun 2005 19:38:53 +0000 (GMT)
	(envelope-from jsimola@gmail.com)
Received: from wproxy.gmail.com (wproxy.gmail.com [64.233.184.204])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 916CD43D53
	for <freebsd-pf@freebsd.org>; Thu, 16 Jun 2005 19:38:53 +0000 (GMT)
	(envelope-from jsimola@gmail.com)
Received: by wproxy.gmail.com with SMTP id 58so634912wri
	for <freebsd-pf@freebsd.org>; Thu, 16 Jun 2005 12:38:52 -0700 (PDT)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com;
	h=received:message-id:date:from:reply-to:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=i2oINX8VEFxJp3DUZcqP/MY+ZLD4aFnyIjkIyCFcHpirJ499nPAQ/+zKnBTzOwwFylWCQRbJ5vP/AnWqLzuC8mBXoQUDJFHYtI03GJuLrhdhaSMIWBPlLKQdN8KA5/A4j4GoYOgsHWOrGoDsvZCsUD+PmWVYh0+kNnGFgWeufJQ=
Received: by 10.54.25.75 with SMTP id 75mr675876wry;
	Thu, 16 Jun 2005 12:38:52 -0700 (PDT)
Received: by 10.54.39.65 with HTTP; Thu, 16 Jun 2005 12:38:52 -0700 (PDT)
Message-ID: <8eea0408050616123835594e12@mail.gmail.com>
Date: Thu, 16 Jun 2005 12:38:52 -0700
From: Jon Simola <jsimola@gmail.com>
To: Andy Hilker <ah@crypta.net>
In-Reply-To: <20050616191047.GA98176@mail.crypta.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
References: <20050616191047.GA98176@mail.crypta.net>
Cc: freebsd-pf@freebsd.org
Subject: Re: synproxy and states
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: jon@abccomm.com
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 16 Jun 2005 19:38:54 -0000

On 6/16/05, Andy Hilker <ah@crypta.net> wrote:

> pass in log quick               proto tcp from x.x.x.x to <public_www> po=
rt { 80,443 }  flags S/SA synproxy state

I've used this a couple times to stop infected clients without totally
locking them out:
pass in quick on vlan130 proto tcp from x.x.x.174 to any synproxy state

> ---internet------ fxp0-(box with pf)-em1 --- (webserver)

If that's a bridge config, synproxy will not work. It's not possible
to tell from the documentation you provided.

--=20
Jon Simola
Systems Administrator
ABC Communications