From owner-freebsd-net@FreeBSD.ORG Fri May 18 00:49:51 2007 Return-Path: X-Original-To: freebsd-net@freebsd.org Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id B427416A402 for ; Fri, 18 May 2007 00:49:51 +0000 (UTC) (envelope-from Mark_Andrews@isc.org) Received: from mx.isc.org (mx.isc.org [204.152.184.167]) by mx1.freebsd.org (Postfix) with ESMTP id 9E3C013C43E for ; Fri, 18 May 2007 00:49:51 +0000 (UTC) (envelope-from Mark_Andrews@isc.org) Received: from farside.isc.org (farside.isc.org [IPv6:2001:4f8:3:bb::5]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "farside.isc.org", Issuer "ISC CA" (verified OK)) by mx.isc.org (Postfix) with ESMTP id 180C2114083; Thu, 17 May 2007 23:51:01 +0000 (UTC) (envelope-from Mark_Andrews@isc.org) Received: from drugs.dv.isc.org (localhost.isc.org [IPv6:::1]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (verified OK)) by farside.isc.org (Postfix) with ESMTP id 977ADE6095; Thu, 17 May 2007 23:51:00 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.1/8.14.1) with ESMTP id l4HNowGe089722; Fri, 18 May 2007 09:50:58 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200705172350.l4HNowGe089722@drugs.dv.isc.org> From: Mark Andrews In-reply-to: Your message of "Fri, 18 May 2007 09:47:56 +1000." Date: Fri, 18 May 2007 09:50:58 +1000 Sender: Mark_Andrews@isc.org Cc: freebsd-net@freebsd.org, Hugo Koji Kobayashi , freebsd-stable@freebsd.org Subject: Re: udp fragmentation with pf/ipf X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 May 2007 00:49:51 -0000 > > This should be rejected as "keep frags" is meaningless here. > > pass out log quick on bge0 proto udp from xxx.xxx.xxx.113/32 to any port = 53 > keep state keep frags > > You need > > pass in quick from any to any with frag keep frag The reason is that "ip" fragments not have next level headers. > -- > Mark Andrews, ISC > 1 Seymour St., Dundas Valley, NSW 2117, Australia > PHONE: +61 2 9871 4742 INTERNET: Mark_Andrews@isc.org -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: Mark_Andrews@isc.org