From owner-freebsd-ipfw@FreeBSD.ORG  Wed Feb  4 11:01:20 2015
Return-Path: <owner-freebsd-ipfw@FreeBSD.ORG>
Delivered-To: freebsd-ipfw@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id EDE93DF6
 for <freebsd-ipfw@freebsd.org>; Wed,  4 Feb 2015 11:01:20 +0000 (UTC)
Received: from nskntqsrv02p.mx.bigpond.com (nskntqsrv02p.mx.bigpond.com
 [61.9.168.234]) by mx1.freebsd.org (Postfix) with ESMTP id 88D9AD6
 for <freebsd-ipfw@freebsd.org>; Wed,  4 Feb 2015 11:01:19 +0000 (UTC)
Received: from nskntcmgw05p ([61.9.169.165]) by nskntmtas03p.mx.bigpond.com
 with ESMTP
 id <20150204105253.IXBI7575.nskntmtas03p.mx.bigpond.com@nskntcmgw05p>
 for <freebsd-ipfw@freebsd.org>; Wed, 4 Feb 2015 10:52:53 +0000
Received: from hermes.heuristicsystems.com.au ([203.41.22.114])
 by nskntcmgw05p with BigPond Outbound
 id oAst1p00N2ThMyb01AstN9; Wed, 04 Feb 2015 10:52:53 +0000
X-Authority-Analysis: v=2.0 cv=W5W6pGqk c=1 sm=1
 a=tBIanQelQkU72CJWnm+MWA==:17 a=XD52yEjQpfAA:10 a=N659UExz7-8A:10
 a=GHIR_BbyAAAA:8 a=0HtSIViG9nkA:10 a=4H3hmQKDrdvAKWf0_aUA:9 a=pILNOxqGKmIA:10
 a=tBIanQelQkU72CJWnm+MWA==:117
Received: from [10.0.5.3] (ewsw01.hs [10.0.5.3]) (authenticated bits=0)
 by hermes.heuristicsystems.com.au (8.14.5/8.13.6) with ESMTP id t146HC3H019822
 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT)
 for <freebsd-ipfw@freebsd.org>; Wed, 4 Feb 2015 17:17:14 +1100 (EST)
 (envelope-from dewayne.geraghty@heuristicsystems.com.au)
Message-ID: <54D1B962.4060700@heuristicsystems.com.au>
Date: Wed, 04 Feb 2015 17:17:06 +1100
From: Dewayne Geraghty <dewayne.geraghty@heuristicsystems.com.au>
User-Agent: Mozilla/5.0 (Windows NT 6.1;
 rv:31.0) Gecko/20100101 Thunderbird/31.4.0
MIME-Version: 1.0
To: freebsd-ipfw@freebsd.org
Subject: Re: [RFC][patch] New "keep-state-only" option
References: <54D0F39B.4070707@FreeBSD.org> <54D1AF04.8050106@freebsd.org>
 <54D1B050.2040706@freebsd.org>
In-Reply-To: <54D1B050.2040706@freebsd.org>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 7bit
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.18-1
Precedence: list
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-ipfw>,
 <mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw/>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
 <mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 04 Feb 2015 11:01:21 -0000

On 4/02/2015 4:38 PM, Julian Elischer wrote:
> On 2/4/15 1:32 PM, Julian Elischer wrote:
>> On 2/4/15 12:13 AM, Lev Serebryakov wrote:
>>>
>>>   And variants with multiple NATs and "nat global" becomes as easy as
>>> this, too! No stupid "skipto", no "keep-state" at "incoming from local
>>> network" parts of firewall, nothing!
>>>
>>> P.S. I HATE this "all any to any" part!
>> can we get rid of it?  (implied).. or just add "everything"
>> also I am not sure about "keep-state-only"..
>> how about 'set-state'?  or record-state as I started with..
> or record-session.. (state always annoyed me)
>
>>
>>
record-state seems more intuitive, while record-session suggests a wider
scope involving session negotiation.
Regards, Dewayne.