Date: Fri, 9 Nov 2007 17:47:27 +0100 From: Max Laier <max@love2party.net> To: Dag-Erling =?iso-8859-1?q?Sm=F8rgrav?= <des@des.no> Cc: freebsd-net@freebsd.org, dhartmei@freebsd.org Subject: Re: pf misfeature Message-ID: <200711091747.37523.max@love2party.net> In-Reply-To: <86y7d7k6m6.fsf@ds4.des.no> References: <86zlxoblmj.fsf@ds4.des.no> <200711090059.54990.max@love2party.net> <86y7d7k6m6.fsf@ds4.des.no>
index | next in thread | previous in thread | raw e-mail
[-- Attachment #1 --] On Friday 09 November 2007, Dag-Erling Smørgrav wrote: > Max Laier <max@love2party.net> writes: > > No, I don't see why these two should behave differently, but you > > should add a "scrub in on sk0" in any case. > > scrub is known and documented to interfere with NFS. Only with broken NFS clients and even then a combination of "no-df" and "random-id" parameters can be used to make them work, too. Without reassembly stateful filtering is impossible (though this still doesn't explain why an explicit "udp keep state"-rule would work). -- /"\ Best regards, | mlaier@freebsd.org \ / Max Laier | ICQ #67774661 X http://pf4freebsd.love2party.net/ | mlaier@EFnet / \ ASCII Ribbon Campaign | Against HTML Mail and News [-- Attachment #2 --] -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4 (FreeBSD) iD8DBQBHNI8pXyyEoT62BG0RAtSNAJ9fVIKW6ExTL52yd8yvhxtTa1+3VgCfYj4Y FlsDPE/O/+FJKeTPLE0rUPw= =ivD3 -----END PGP SIGNATURE-----help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200711091747.37523.max>