Date: Thu, 08 Nov 2007 23:34:14 +0100 From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= <des@des.no> To: Max Laier <max@love2party.net> Cc: freebsd-net@freebsd.org Subject: Re: pf misfeature Message-ID: <86fxzgl63d.fsf@ds4.des.no> In-Reply-To: <200711082259.46222.max@love2party.net> (Max Laier's message of "Thu\, 8 Nov 2007 22\:59\:35 %2B0100") References: <86zlxoblmj.fsf@ds4.des.no> <200711082043.31664.max@love2party.net> <86ve8cbiee.fsf@ds4.des.no> <200711082259.46222.max@love2party.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Max Laier <max@love2party.net> writes:
> On Thursday 08 November 2007, Dag-Erling Sm=C3=B8rgrav wrote:
> > With "pass on $eth from $lan to $lan", NFS doesn't work. With "pass on
> > $eth inet proto { tcp, udp } from $lan to $lan", it does.
> thinking about it, this could be a strange interaction with skip
> steps. Could you provide "pfctl -gvsr" with either rule(s)? In
> private mail if you prefer.
With (NFS works):
@0 block return quick inet6 all
[ Skip steps: i=3D3 d=3D3 p=3D2 sa=3D4 sp=3Dend da=3D3 dp=3D3 ]
[ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
[ Evaluations: 143 Packets: 0 Bytes: 0 States: 0 =
]
@1 block return log all
[ Skip steps: i=3D3 d=3D3 sa=3D4 sp=3Dend da=3D3 dp=3D3 ]
[ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
[ Evaluations: 143 Packets: 0 Bytes: 0 States: 0 =
]
@2 pass inet proto icmp all icmp-type echoreq keep state
[ Skip steps: f=3Dend sa=3D4 sp=3Dend ]
[ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
[ Evaluations: 143 Packets: 0 Bytes: 0 States: 0 =
]
@3 pass in on sk0 inet proto tcp from any to (sk0:1) port =3D ssh flags S/S=
A keep state
[ Skip steps: i=3Dend f=3Dend p=3D5 sp=3Dend ]
[ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
[ Evaluations: 143 Packets: 0 Bytes: 0 States: 0 =
]
@4 pass on sk0 inet proto tcp from (sk0:network:1) to (sk0:network:1) flags=
S/SA keep state
[ Skip steps: i=3Dend d=3D6 f=3Dend sa=3D6 sp=3Dend da=3D6 dp=3Dend ]
[ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
[ Evaluations: 61 Packets: 1386 Bytes: 158934 States: 2 =
]
@5 pass on sk0 inet proto udp from (sk0:network:1) to (sk0:network:1) keep =
state
[ Skip steps: i=3Dend f=3Dend sp=3Dend dp=3Dend ]
[ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
[ Evaluations: 143 Packets: 267 Bytes: 47931 States: 3 =
]
@6 pass out on sk0 inet proto tcp from (sk0:1) to ! (sk0:network:1) flags S=
/SA keep state
[ Skip steps: i=3Dend d=3Dend f=3Dend sa=3Dend sp=3Dend da=3Dend dp=3Dend=
]
[ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
[ Evaluations: 143 Packets: 0 Bytes: 0 States: 0 =
]
@7 pass out on sk0 inet proto udp from (sk0:1) to ! (sk0:network:1) keep st=
ate
[ Skip steps: i=3Dend d=3Dend f=3Dend p=3Dend sa=3Dend sp=3Dend da=3Dend =
dp=3Dend ]
[ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
[ Evaluations: 52 Packets: 0 Bytes: 0 States: 0 =
]
Without (NFS doesn't work):
@0 block return quick inet6 all
[ Skip steps: i=3D3 d=3D3 p=3D2 sa=3D4 sp=3Dend da=3D3 dp=3D3 ]
[ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
[ Evaluations: 18 Packets: 0 Bytes: 0 States: 0 =
]
@1 block return log all
[ Skip steps: i=3D3 d=3D3 sa=3D4 sp=3Dend da=3D3 dp=3D3 ]
[ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
[ Evaluations: 18 Packets: 4 Bytes: 5784 States: 0 =
]
@2 pass inet proto icmp all icmp-type echoreq keep state
[ Skip steps: f=3D4 sa=3D4 sp=3Dend ]
[ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
[ Evaluations: 18 Packets: 0 Bytes: 0 States: 0 =
]
@3 pass in on sk0 inet proto tcp from any to (sk0:1) port =3D ssh flags S/S=
A keep state
[ Skip steps: i=3Dend sp=3Dend ]
[ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
[ Evaluations: 18 Packets: 69 Bytes: 9760 States: 1 =
]
@4 pass on sk0 from (sk0:network:1) to (sk0:network:1) flags S/SA keep state
[ Skip steps: i=3Dend f=3Dend p=3Dend sp=3Dend dp=3Dend ]
[ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
[ Evaluations: 18 Packets: 30 Bytes: 3443 States: 13=
]
@5 pass out on sk0 from (sk0:1) to ! (sk0:network:1) flags S/SA keep state
[ Skip steps: i=3Dend d=3Dend f=3Dend p=3Dend sa=3Dend sp=3Dend da=3Dend =
dp=3Dend ]
[ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ]
[ Evaluations: 18 Packets: 0 Bytes: 0 States: 0 =
]
DES
--=20
Dag-Erling Sm=C3=B8rgrav - des@des.no
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?86fxzgl63d.fsf>