Date: Mon, 23 Jul 2012 12:53:41 +0200 From: "Tonix (Antonio Nati)" <tonix@interazioni.it> To: Daniel Hartmeier <daniel@benzedrine.cx> Cc: "freebsd-pf@freebsd.org" <freebsd-pf@freebsd.org> Subject: Re: Question on packet filter using in and out interfaces Message-ID: <500D2D35.4070608@interazioni.it> In-Reply-To: <20120723095509.GB32530@insomnia.benzedrine.cx> References: <500826BD.3070602@interazioni.it> <9EB23F6C23A8B6488E8BCC92A48E83264BB4D26F80@PEMEXMBXVS04.jellyfishnet.co.uk.local> <500AB340.2040405@interazioni.it> <9EB23F6C23A8B6488E8BCC92A48E83264BB4D27241@PEMEXMBXVS04.jellyfishnet.co.uk.local> <500AC91F.9090907@interazioni.it> <20120721182316.GA32530@insomnia.benzedrine.cx> <500D1B57.8080405@interazioni.it> <20120723095509.GB32530@insomnia.benzedrine.cx>
next in thread | previous in thread | raw e-mail | index | archive | help
Il 23/07/2012 11:55, Daniel Hartmeier ha scritto:
> On Mon, Jul 23, 2012 at 11:37:27AM +0200, Tonix (Antonio Nati) wrote:
>
>> What it is not clear to me is related to in/out rules evaluation.
>>
>> Diagram starts obviously from the packet entering the system, until the
>> packet exits the system. When the packet enters the system, which rules
>> are evaluated? All rules related to interface, both for IN and OUT? Or
>> only IN?
>
> During both phases (first incoming on one interface, then outgoing on
> the other interface), all rules are evaluated.
>
> Rules can omit the direction (e.g. 'pass from src to dst'), and such
> rules can match in either phase, or both.
>
> If rules do specify a direction (e.g. 'pass in from src to dst'), they are
> still evaluated during both in and out phase, but they cannot possibly
> match during the wrong phase.
Daniel,
thanks for the detailed explanation.
So, does that mean the OUT phase evaluation always occurs when IN phase
has been positive (packet should pass)?
I'm thinking to management of a lot of interfaces, where one is the WAN,
and others are DMZ and/or customers dedicated subnets.
I'd love to put basic protections on WAN input, and then permit all
other interfaces to define its own rules for packets coming/going
from/to the specific subnet.
According to what I understand of your explanation, each interface could
have its own IN rules, and if the IN rules of a specific INPUT interface
are successfull, the OUT rules of the 'outgoing' interface are then
evaluated.
This would be wonderful, as each interface could have both IN and OUT
rules which do not interphere with or break other interfaces rules. And
would permit to write the most of rules just once, according to each
interface needs.
Regards,
Tonino
>
>> PF manual says all rules in pf.conf are evaluated, so I suppose all
>> rules applying to that interface are evaluated... or only IN rules are
>> evaluated in this first step, and only OUT rules are evaluated in second
>> step?
>
> There isn't really any difference: while all rules are evaluated, only
> the IN rules can possibly match (in the first step), so there's no way
> you notice the OUT rules are being evaluated...
>
> Daniel
>
--
------------------------------------------------------------
Inter@zioni Interazioni di Antonio Nati
http://www.interazioni.it tonix@interazioni.it
------------------------------------------------------------
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?500D2D35.4070608>