From owner-freebsd-pf@FreeBSD.ORG  Tue Jul 29 11:33:28 2008
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 37521106566C
	for <freebsd-pf@freebsd.org>; Tue, 29 Jul 2008 11:33:28 +0000 (UTC)
	(envelope-from jdc@parodius.com)
Received: from mx01.sc1.parodius.com (mx01.sc1.parodius.com [72.20.106.3])
	by mx1.freebsd.org (Postfix) with ESMTP id 298DF8FC22
	for <freebsd-pf@freebsd.org>; Tue, 29 Jul 2008 11:33:28 +0000 (UTC)
	(envelope-from jdc@parodius.com)
Received: by mx01.sc1.parodius.com (Postfix, from userid 1000)
	id 1326C1CC0AC; Tue, 29 Jul 2008 04:33:28 -0700 (PDT)
Date: Tue, 29 Jul 2008 04:33:28 -0700
From: Jeremy Chadwick <koitsu@FreeBSD.org>
To: Peter Wullinger <peter.wullinger@googlemail.com>
Message-ID: <20080729113328.GA67866@eos.sc1.parodius.com>
References: <488EE046.4010602@skoberne.net> <488EE858.9010708@googlemail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <488EE858.9010708@googlemail.com>
User-Agent: Mutt/1.5.18 (2008-05-17)
Cc: freebsd-pf@freebsd.org
Subject: Re: pf randomly blocks specific packets?
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 29 Jul 2008 11:33:28 -0000

On Tue, Jul 29, 2008 at 11:52:24AM +0200, Peter Wullinger wrote:
> Nejc ?koberne wrote:
>> pass in quick on $int_Trust from $addr_sysSvarun to any keep state
> Note: You can remove "keep state". This is implicit for newer version of pf.
>> pass quick on $int_Loop all
>> pass quick on $int_Jails all
> Note: These keep state, see above. You might want to add "no state" here,
> to decrease state table usage.

Or better use, use "set skip on $int_Loop $int_Jails", and avoid having
pf process any of them.

-- 
| Jeremy Chadwick                                jdc at parodius.com |
| Parodius Networking                       http://www.parodius.com/ |
| UNIX Systems Administrator                  Mountain View, CA, USA |
| Making life hard for others since 1977.              PGP: 4BD6C0CB |