From owner-freebsd-net@FreeBSD.ORG  Thu Nov  8 20:40:37 2007
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 7B36C16A477
	for <freebsd-net@freebsd.org>; Thu,  8 Nov 2007 20:40:37 +0000 (UTC)
	(envelope-from max@love2party.net)
Received: from moutng.kundenserver.de (moutng.kundenserver.de
	[212.227.126.177])
	by mx1.freebsd.org (Postfix) with ESMTP id 09AB413C481
	for <freebsd-net@freebsd.org>; Thu,  8 Nov 2007 20:40:37 +0000 (UTC)
	(envelope-from max@love2party.net)
Received: from amd64.laiers.local (dslb-088-066-048-233.pools.arcor-ip.net
	[88.66.48.233])
	by mrelayeu.kundenserver.de (node=mrelayeu1) with ESMTP (Nemesis)
	id 0MKwpI-1IqEAv0y0Y-0002dj; Thu, 08 Nov 2007 21:40:29 +0100
From: Max Laier <max@love2party.net>
Organization: FreeBSD
To: Dag-Erling =?iso-8859-1?q?Sm=F8rgrav?= <des@des.no>
Date: Thu, 8 Nov 2007 21:39:44 +0100
User-Agent: KMail/1.9.7
References: <86zlxoblmj.fsf@ds4.des.no> <200711082043.31664.max@love2party.net>
	<86ve8cbiee.fsf@ds4.des.no>
In-Reply-To: <86ve8cbiee.fsf@ds4.des.no>
X-Face: ,,8R(x[kmU]tKN@>gtH1yQE4aslGd<hB5S>u+2];
	R]*pL,U>^H?)gW@49@wdJ`H<=?utf-8?q?=25=7D*=5FBD=0A=09U=5For=3D=5CmOZf764=26nYj=3DJYbR1PW0ud?=>|!~,,CPC.1-D$FG@0h3#'5"k{V]a~.<=?utf-8?q?mZ=7D44=23Se=7Em=0A=09Fe=7E=5C=5DX5B=5D=5Fxj?=(ykz9QKMw_l0C2AQ]}Ym8)fU
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="nextPart1473742.UZxcrOatyN";
	protocol="application/pgp-signature"; micalg=pgp-sha1
Content-Transfer-Encoding: 7bit
Message-Id: <200711082139.52958.max@love2party.net>
X-Provags-ID: V01U2FsdGVkX19vVDtQ6x3+WjUHATHC1w4pkW5XK2kOkxkm1mv
	glWpy4hISynH0SINZhxdD9Pi5OmUNvCts72qwF1vP9y2e/61oA
	OwJBcU4tGLjlEH5ztTyfFR4Xqzrj9TAMbyDRLOVTSk=
Cc: freebsd-net@freebsd.org
Subject: Re: pf misfeature
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 08 Nov 2007 20:40:37 -0000

--nextPart1473742.UZxcrOatyN
Content-Type: text/plain;
  charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

On Thursday 08 November 2007, Dag-Erling Sm=C3=B8rgrav wrote:
> Max Laier <max@love2party.net> writes:
> > On Thursday 08 November 2007, Dag-Erling Sm=C3=B8rgrav wrote:
> >> but what you actually get is this:
> >>
> >>   pass on $eth from $lan to $lan flags S/SA keep state
> >>
> >> which only matches TCP handshakes, so your UDP streams are screwed.
> >
> > I don't think this is true.
>
> With "pass on $eth from $lan to $lan", NFS doesn't work.  With "pass on
> $eth inet proto { tcp, udp } from $lan to $lan", it does.

Works for me.  I can NFS over UDP in both directions with the following=20
rules (expanded):

block drop log all
pass log on bge0 from (bge0:network) to (bge0:network) flags S/SA keep=20
    state

=2D-=20
/"\  Best regards,                      | mlaier@freebsd.org
\ /  Max Laier                          | ICQ #67774661
 X   http://pf4freebsd.love2party.net/  | mlaier@EFnet
/ \  ASCII Ribbon Campaign              | Against HTML Mail and News

--nextPart1473742.UZxcrOatyN
Content-Type: application/pgp-signature; name=signature.asc 
Content-Description: This is a digitally signed message part.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.4 (FreeBSD)

iD8DBQBHM3QYXyyEoT62BG0RAhQpAKCAJ8T0zjHRdqjlgqz6pqpSP7A1LwCfbCOs
iSjNzqkwUENZGZaB8zf7Vh8=
=rPAJ
-----END PGP SIGNATURE-----

--nextPart1473742.UZxcrOatyN--