From owner-freebsd-pf@FreeBSD.ORG Wed May 7 22:06:43 2008 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 2C2291065672 for ; Wed, 7 May 2008 22:06:43 +0000 (UTC) (envelope-from ansarm@gmail.com) Received: from py-out-1112.google.com (py-out-1112.google.com [64.233.166.178]) by mx1.freebsd.org (Postfix) with ESMTP id D5F798FC14 for ; Wed, 7 May 2008 22:06:42 +0000 (UTC) (envelope-from ansarm@gmail.com) Received: by py-out-1112.google.com with SMTP id u52so649970pyb.10 for ; Wed, 07 May 2008 15:06:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:from:to:cc:references:in-reply-to:subject:date:message-id:mime-version:content-type:content-transfer-encoding:x-mailer:thread-index:content-language; bh=wtYPysHB459mfjqYgzQs/rWSwzVmTniQ9Ha+xgRbZLw=; b=eDA2gEbI7j2rt+xQw8xQ4pgnWl/ZxvqW6sYAWyeEd9u7/ifhmoCLdCPaBX/2/qCykZITwKb1tdC1A9wmtkeaw0yo9f3z6ReTZKbOUmJT49/8hoNxGNvKwpqKLYTJrcDvu01+oMVXJYdZXAKSiUnOI8NZSKvAw3rw6Ro546/rf+g= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:to:cc:references:in-reply-to:subject:date:message-id:mime-version:content-type:content-transfer-encoding:x-mailer:thread-index:content-language; b=SJxirAquVmdCwOy+N/XSZAgS1ZkjhhFdvW22R03V+S0rzzEUy2anXr6LPL53i6yrbmT+kBSyj0ZWB2VIc2dHxMrG/bh6avYD/azIDfonWi9GrJjfmWxzqSqg2HHD/cKwTGbsMoYlZ5e85F2qAraO27GLfZ4grXtpj+sECFrytWY= Received: by 10.65.163.8 with SMTP id q8mr5159411qbo.97.1210198001666; Wed, 07 May 2008 15:06:41 -0700 (PDT) Received: from ansarmm2 ( [206.248.190.95]) by mx.google.com with ESMTPS id f14sm2073841qba.22.2008.05.07.15.06.39 (version=SSLv3 cipher=RC4-MD5); Wed, 07 May 2008 15:06:40 -0700 (PDT) From: "Ansar Mohammed" To: "'Jeremy Chadwick'" References: <004f01c8b068$89c89350$9d59b9f0$@com> <005101c8b06b$5f0743c0$1d15cb40$@com> <008b01c8b081$c74692e0$55d3b8a0$@com> <482215F4.1080806@quis.cx> <00a401c8b084$87da9540$978fbfc0$@com> <20080507214351.GA74641@eos.sc1.parodius.com> In-Reply-To: <20080507214351.GA74641@eos.sc1.parodius.com> Date: Wed, 7 May 2008 18:06:38 -0400 Message-ID: <00bc01c8b08e$a080cf60$e1826e20$@com> MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: Aciwi3bKXr789ITVSQqdkHZ31FtuSwAAr9jA Content-Language: en-ca Cc: freebsd-pf@freebsd.org Subject: RE: UDP weirdness X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 May 2008 22:06:43 -0000 So I am using FreeBSD 7 and it doesn't work either way with "keep state" there or not. The only catch here is that everything is running on VMWare, although that should not matter. I have been using pf for about 2 years now. I feel this may be a bit of a bug. I even set the state-policy to floating (which I believe is default) and still I need the second rule. > -----Original Message----- > From: Jeremy Chadwick [mailto:koitsu@freebsd.org] > Sent: May 7, 2008 5:44 PM > To: Ansar Mohammed > Cc: 'Jille'; freebsd-pf@freebsd.org > Subject: Re: UDP weirdness > > On Wed, May 07, 2008 at 04:54:22PM -0400, Ansar Mohammed wrote: > > But I thought pf would be tracking state? > > Isnt that the whole point of statefull firewalls? > > UDP is stateless, however pf still tracks the "state" in the sense that > it knows when there's an outbound or inbound initial packet for UDP, > thus creates a "state" for it. It can do the same with ICMP. I > believe > the teardown/state removal is based on a timeout (of when it last sees > packets matching that src/dst IP and port). > > Keep in mind that if you're using RELENG_6, you'll need "keep state" on > those pass in/pass out rules you used. If you're using RELENG_7, "keep > state" is implicit, so you won't need to specify it in your config. > > -- > | Jeremy Chadwick jdc at parodius.com | > | Parodius Networking http://www.parodius.com/ | > | UNIX Systems Administrator Mountain View, CA, USA | > | Making life hard for others since 1977. PGP: 4BD6C0CB |