From owner-freebsd-net@FreeBSD.ORG Thu Nov 8 22:34:30 2007 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id AB0A016A420 for ; Thu, 8 Nov 2007 22:34:30 +0000 (UTC) (envelope-from des@des.no) Received: from tim.des.no (tim.des.no [194.63.250.121]) by mx1.freebsd.org (Postfix) with ESMTP id 37ABD13C494 for ; Thu, 8 Nov 2007 22:34:30 +0000 (UTC) (envelope-from des@des.no) Received: from tim.des.no (localhost [127.0.0.1]) by spam.des.no (Postfix) with ESMTP id 9E5912092; Thu, 8 Nov 2007 23:34:14 +0100 (CET) X-Spam-Tests: AWL X-Spam-Learn: disabled X-Spam-Score: -0.1/3.0 X-Spam-Checker-Version: SpamAssassin 3.2.3 (2007-08-08) on tim.des.no Received: from ds4.des.no (des.no [80.203.243.180]) by smtp.des.no (Postfix) with ESMTP id 6E752208D; Thu, 8 Nov 2007 23:34:14 +0100 (CET) Received: by ds4.des.no (Postfix, from userid 1001) id 4CF958448F; Thu, 8 Nov 2007 23:34:14 +0100 (CET) From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= To: Max Laier References: <86zlxoblmj.fsf@ds4.des.no> <200711082043.31664.max@love2party.net> <86ve8cbiee.fsf@ds4.des.no> <200711082259.46222.max@love2party.net> Date: Thu, 08 Nov 2007 23:34:14 +0100 In-Reply-To: <200711082259.46222.max@love2party.net> (Max Laier's message of "Thu\, 8 Nov 2007 22\:59\:35 +0100") Message-ID: <86fxzgl63d.fsf@ds4.des.no> User-Agent: Gnus/5.110006 (No Gnus v0.6) Emacs/22.1 (berkeley-unix) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Cc: freebsd-net@freebsd.org Subject: Re: pf misfeature X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Nov 2007 22:34:30 -0000 Max Laier writes: > On Thursday 08 November 2007, Dag-Erling Sm=C3=B8rgrav wrote: > > With "pass on $eth from $lan to $lan", NFS doesn't work. With "pass on > > $eth inet proto { tcp, udp } from $lan to $lan", it does. > thinking about it, this could be a strange interaction with skip > steps. Could you provide "pfctl -gvsr" with either rule(s)? In > private mail if you prefer. With (NFS works): @0 block return quick inet6 all [ Skip steps: i=3D3 d=3D3 p=3D2 sa=3D4 sp=3Dend da=3D3 dp=3D3 ] [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] [ Evaluations: 143 Packets: 0 Bytes: 0 States: 0 = ] @1 block return log all [ Skip steps: i=3D3 d=3D3 sa=3D4 sp=3Dend da=3D3 dp=3D3 ] [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] [ Evaluations: 143 Packets: 0 Bytes: 0 States: 0 = ] @2 pass inet proto icmp all icmp-type echoreq keep state [ Skip steps: f=3Dend sa=3D4 sp=3Dend ] [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] [ Evaluations: 143 Packets: 0 Bytes: 0 States: 0 = ] @3 pass in on sk0 inet proto tcp from any to (sk0:1) port =3D ssh flags S/S= A keep state [ Skip steps: i=3Dend f=3Dend p=3D5 sp=3Dend ] [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] [ Evaluations: 143 Packets: 0 Bytes: 0 States: 0 = ] @4 pass on sk0 inet proto tcp from (sk0:network:1) to (sk0:network:1) flags= S/SA keep state [ Skip steps: i=3Dend d=3D6 f=3Dend sa=3D6 sp=3Dend da=3D6 dp=3Dend ] [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] [ Evaluations: 61 Packets: 1386 Bytes: 158934 States: 2 = ] @5 pass on sk0 inet proto udp from (sk0:network:1) to (sk0:network:1) keep = state [ Skip steps: i=3Dend f=3Dend sp=3Dend dp=3Dend ] [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] [ Evaluations: 143 Packets: 267 Bytes: 47931 States: 3 = ] @6 pass out on sk0 inet proto tcp from (sk0:1) to ! (sk0:network:1) flags S= /SA keep state [ Skip steps: i=3Dend d=3Dend f=3Dend sa=3Dend sp=3Dend da=3Dend dp=3Dend= ] [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] [ Evaluations: 143 Packets: 0 Bytes: 0 States: 0 = ] @7 pass out on sk0 inet proto udp from (sk0:1) to ! (sk0:network:1) keep st= ate [ Skip steps: i=3Dend d=3Dend f=3Dend p=3Dend sa=3Dend sp=3Dend da=3Dend = dp=3Dend ] [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] [ Evaluations: 52 Packets: 0 Bytes: 0 States: 0 = ] Without (NFS doesn't work): @0 block return quick inet6 all [ Skip steps: i=3D3 d=3D3 p=3D2 sa=3D4 sp=3Dend da=3D3 dp=3D3 ] [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] [ Evaluations: 18 Packets: 0 Bytes: 0 States: 0 = ] @1 block return log all [ Skip steps: i=3D3 d=3D3 sa=3D4 sp=3Dend da=3D3 dp=3D3 ] [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] [ Evaluations: 18 Packets: 4 Bytes: 5784 States: 0 = ] @2 pass inet proto icmp all icmp-type echoreq keep state [ Skip steps: f=3D4 sa=3D4 sp=3Dend ] [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] [ Evaluations: 18 Packets: 0 Bytes: 0 States: 0 = ] @3 pass in on sk0 inet proto tcp from any to (sk0:1) port =3D ssh flags S/S= A keep state [ Skip steps: i=3Dend sp=3Dend ] [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] [ Evaluations: 18 Packets: 69 Bytes: 9760 States: 1 = ] @4 pass on sk0 from (sk0:network:1) to (sk0:network:1) flags S/SA keep state [ Skip steps: i=3Dend f=3Dend p=3Dend sp=3Dend dp=3Dend ] [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] [ Evaluations: 18 Packets: 30 Bytes: 3443 States: 13= ] @5 pass out on sk0 from (sk0:1) to ! (sk0:network:1) flags S/SA keep state [ Skip steps: i=3Dend d=3Dend f=3Dend p=3Dend sa=3Dend sp=3Dend da=3Dend = dp=3Dend ] [ queue: qname=3D qid=3D0 pqname=3D pqid=3D0 ] [ Evaluations: 18 Packets: 0 Bytes: 0 States: 0 = ] DES --=20 Dag-Erling Sm=C3=B8rgrav - des@des.no