Date: Wed, 03 Sep 2008 14:49:25 -0400 From: Jon Radel <jon@radel.com> To: Peter Wullinger <peter.wullinger@googlemail.com> Cc: Guido van Rooij <guido@gvr.org>, freebsd-pf@freebsd.org Subject: Re: keeping state on outgoing connections fails (?) Message-ID: <48BEDC35.3050802@radel.com> In-Reply-To: <20080903161759.GA2761@kaliope.home> References: <20080903110943.GA25396@gvr.gvr.org> <20080903152632.GA89687@icarus.home.lan> <20080903161759.GA2761@kaliope.home>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
Peter Wullinger wrote:
> I'll reply to Jeremy, since his answer somehow confused me.
>
> In epistula a Jeremy Chadwick, die horaque Wed Sep 3 17:26:32 2008:
>> On Wed, Sep 03, 2008 at 01:09:43PM +0200, Guido van Rooij wrote:
>>> Setup: FreeBSD 6.3 system with 2 interfaces: ep0 and bge0.
>>>
>>> ep0: 1.2.3.4/24
>>> bge0: 10.0.0.1/24
>>>
>>> ruleset (made as simple as possible):
>>> pass in quick on ep0 inet from 1.2.3.1 to 10.0.0.2
>>> block drop out log quick on ep0 all
>>> pass out quick on bge0 inet proto tcp from 1.2.3.1 to 10.0.0.2 keep state
>
> At little bit of guessing led me to the (possible, I have not tested
> this) culprit: Is your state-policy set to "floating" or "if-bound"?
>
> From a casual look at the log entries and traffic snapshots you have sent,
> this seems to be pf working in "if-bound" mode. In this case, the
> created state table entry matches incoming on bge0, but not on
> outgoing on ep0 any more (packets pass through pf twice, as expected).
>
> This still maybe a bug, but it's common to rule out all possible
> culprits before spreading blame.
>
My understanding is that "if-bound" would have an effect on this
scenario if the OP, for example, had two interfaces on the same "side"
of the firewall, say bge0 and bge1, and packets for a connection that
was originally established by a packet outbound on bge0 might cross on
either bge0 or bge1 traveling in the same direction with respect to the
FreeBSD router with the configuration.
In this case we're talking about packets that are traveling in one
direction with respect to the router on bge0 and the other direction on
ep0, so you'd need separate state entries no matter what you've done
with if-bound.
--Jon Radel
[-- Attachment #2 --]
0 *H
01 0 + 0 *H
100\mtv0
*H
0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA0
080324165921Z
090324165921Z0^10 URadel10U*
Jon Thomas10UJon Thomas Radel1 0 *H
jon@radel.com0"0
*H
0
t,P p#
٬q_2=L-^m >z3ʟV![([ AoE}ϛ3/6?cWx(/)'$6sTl<*i'=uox Mbt
rdtnxud1R6T>zU0FZ,vN9NP{>qE`^P; *Wg/jN*OVՠQMB(=:
*0(0U 0
jon@radel.com0 U 0 0
*H
h!oܨ[А!fN#[Z
b$3?x&$~Ħ9}`MX[It}/bXZajgxɥ' 2NrtWAr sFި'^@mDVw\)00\mtv0
*H
0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA0
080324165921Z
090324165921Z0^10 URadel10U*
Jon Thomas10UJon Thomas Radel1 0 *H
jon@radel.com0"0
*H
0
t,P p#
٬q_2=L-^m >z3ʟV![([ AoE}ϛ3/6?cWx(/)'$6sTl<*i'=uox Mbt
rdtnxud1R6T>zU0FZ,vN9NP{>qE`^P; *Wg/jN*OVՠQMB(=:
*0(0U 0
jon@radel.com0 U 0 0
*H
h!oܨ[А!fN#[Z
b$3?x&$~Ħ9}`MX[It}/bXZajgxɥ' 2NrtWAr sFި'^@mDVw\)0?0
0
*H
01 0 UZA10U Western Cape10U Cape Town10U
Thawte Consulting1(0&U Certification Services Division1$0"UThawte Personal Freemail CA1+0) *H
personal-freemail@thawte.com0
030717000000Z
130716235959Z0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA00
*H
0 Ħ<UsUNʙZ hup [v :aQP
0cZ,p+Z?qV˯< 6$*+w=+>@dקe*TH<a@ dr` 00U 0 0CU <0:08642http://crl.thawte.com/ThawtePersonalFreemailCA.crl0 U 0)U "0 0 10UPrivateLabel2-1380
*H
HP .
fgCL!6 -6/ P p<ab:~ t%Pb'qW%ݩ9 Oe_N4[5MwV!x!5$ F]_eO1d0`0v0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAmtv0 + 0 *H
1 *H
0 *H
1
080903184925Z0# *H
1Ȕ^.,r*&0R *H
1E0C0
*H
0*H
0
*H
@0+0
*H
(0 +71x0v0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAmtv0 *H
1xv0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAmtv0
*H
gɻվnt FxUdd!poΖ@F/sirz\q! ,EPD!`W}BZGz;7E /MM˶YޤN 㥿Աh{tqŞG (er
<39_&ceYXz5 P?,<}^cz^aXm[vgltP)w|kI)P1*|MGPB#5
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?48BEDC35.3050802>