Date: Fri, 09 Aug 2024 08:34:27 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 280701] FreeBSD-SA-24:05 fix breaks ICMP/ICMP6 (ping, tracertoute) states handling in pf firewall Message-ID: <bug-280701-227@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D280701 Bug ID: 280701 Summary: FreeBSD-SA-24:05 fix breaks ICMP/ICMP6 (ping, tracertoute) states handling in pf firewall Product: Base System Version: 14.1-RELEASE Hardware: Any OS: Any Status: New Severity: Affects Some People Priority: --- Component: kern Assignee: bugs@FreeBSD.org Reporter: doktornotor@mailinator.com On systems with the FreeBSD-SA-24:05 fix [1] applied and pf firewall enable= d, replies to ping initiated from machines on networks behind pf firewall/NAT = to anything outside the local networks get blocked (state violation), resultin= g in 'Request timed out'. - Reverting the security "fix" fixes the issue. - Disabling pf completely (pfctl -d) mitigates the issue. - For IPv4, permitting ICMP time exceeded in addition to echo reply does not help either (NAT state is missing). [1] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:05.pf.asc --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-280701-227>