Date: Mon, 23 Jul 2012 11:55:09 +0200 From: Daniel Hartmeier <daniel@benzedrine.cx> To: "Tonix (Antonio Nati)" <tonix@interazioni.it> Cc: "freebsd-pf@freebsd.org" <freebsd-pf@freebsd.org> Subject: Re: Question on packet filter using in and out interfaces Message-ID: <20120723095509.GB32530@insomnia.benzedrine.cx> In-Reply-To: <500D1B57.8080405@interazioni.it> References: <500826BD.3070602@interazioni.it> <9EB23F6C23A8B6488E8BCC92A48E83264BB4D26F80@PEMEXMBXVS04.jellyfishnet.co.uk.local> <500AB340.2040405@interazioni.it> <9EB23F6C23A8B6488E8BCC92A48E83264BB4D27241@PEMEXMBXVS04.jellyfishnet.co.uk.local> <500AC91F.9090907@interazioni.it> <20120721182316.GA32530@insomnia.benzedrine.cx> <500D1B57.8080405@interazioni.it>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Jul 23, 2012 at 11:37:27AM +0200, Tonix (Antonio Nati) wrote: > What it is not clear to me is related to in/out rules evaluation. > > Diagram starts obviously from the packet entering the system, until the > packet exits the system. When the packet enters the system, which rules > are evaluated? All rules related to interface, both for IN and OUT? Or > only IN? During both phases (first incoming on one interface, then outgoing on the other interface), all rules are evaluated. Rules can omit the direction (e.g. 'pass from src to dst'), and such rules can match in either phase, or both. If rules do specify a direction (e.g. 'pass in from src to dst'), they are still evaluated during both in and out phase, but they cannot possibly match during the wrong phase. > PF manual says all rules in pf.conf are evaluated, so I suppose all > rules applying to that interface are evaluated... or only IN rules are > evaluated in this first step, and only OUT rules are evaluated in second > step? There isn't really any difference: while all rules are evaluated, only the IN rules can possibly match (in the first step), so there's no way you notice the OUT rules are being evaluated... Daniel
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20120723095509.GB32530>