From owner-freebsd-questions@FreeBSD.ORG Wed Jul 28 15:45:27 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2031516A4CE for ; Wed, 28 Jul 2004 15:45:27 +0000 (GMT) Received: from lilzmailso01.liwest.at (lilzmailso01.liwest.at [212.33.55.23]) by mx1.FreeBSD.org (Postfix) with ESMTP id DBE9D43D48 for ; Wed, 28 Jul 2004 15:45:26 +0000 (GMT) (envelope-from dgw@liwest.at) Received: from cm248-230.liwest.at ([81.10.248.230]) by lilzmailso01.liwest.at with esmtp (Exim 4.24) id 1BpqcC-0004qA-Np; Wed, 28 Jul 2004 17:45:13 +0200 From: Daniela To: "Steve Bertrand" Date: Wed, 28 Jul 2004 16:37:23 +0000 User-Agent: KMail/1.5.3 References: <200407281452.00859.dgw@liwest.at> <200407281611.09200.dgw@liwest.at> <3652.209.167.16.15.1091028200.squirrel@209.167.16.15> In-Reply-To: <3652.209.167.16.15.1091028200.squirrel@209.167.16.15> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200407281637.23563.dgw@liwest.at> cc: questions@freebsd.org Subject: Re: Problems after IP change X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: dgw@liwest.at List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Jul 2004 15:45:27 -0000 On Wednesday 28 July 2004 15:23, Steve Bertrand wrote: > > Yes, it works, but of course I can't leave this rule in all the time. > > The SYN/ACK packet that comes back from the remote server is denied by > rule > > > 01900. But it should be allowed by the check-state rule. > > > >> Also, I know you haven't changed anything, but what does the output > > from > > >> this command state?: > >> # sysctl net.inet.ip.forwarding > > > > It is set to 1. I changed this a long time ago. > > I figured so...what happens if you add 'keep-state' to rules 20000, 20002 > and 20003? Nothing. BTW, here we have the problem: The initial SYN packet isn't matched by rule 11700 (setup keep-state). Setup means the SYN flag is set, right? So why is it not matched? If I remove the "setup" keyword to match all outgoing packets, the SYN/ACK from the server is still denied by rule 01900.