From owner-freebsd-stable Thu Mar 14 9:26:35 2002 Delivered-To: freebsd-stable@freebsd.org Received: from bast.unixathome.org (bast.unixathome.org [216.187.105.150]) by hub.freebsd.org (Postfix) with ESMTP id D801737B405 for ; Thu, 14 Mar 2002 09:26:28 -0800 (PST) Received: from wocker (wocker.unixathome.org [192.168.0.99]) by bast.unixathome.org (Postfix) with ESMTP id DEF953F0E; Thu, 14 Mar 2002 12:26:27 -0500 (EST) From: "Dan Langille" Organization: DVL Software Limited To: Chris Johnson Date: Thu, 14 Mar 2002 12:26:27 -0500 MIME-Version: 1.0 Subject: Re: ipfilter keep state broken? Reply-To: dan@langille.org Cc: freebsd-stable@FreeBSD.ORG In-reply-to: <20020314121048.A43100@palomine.net> References: <20020314164723.4E1543F0E@bast.unixathome.org>; from dan@langille.org on Thu, Mar 14, 2002 at 11:47:21AM -0500 X-mailer: Pegasus Mail for Windows (v4.01) Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT Content-description: Mail message body Message-Id: <20020314172627.DEF953F0E@bast.unixathome.org> Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On 14 Mar 2002 at 12:10, Chris Johnson wrote: > On Thu, Mar 14, 2002 at 11:47:21AM -0500, Dan Langille wrote: > > I upgraded my webserver on March 9 from the post 4.5-RELASE stable. Today > > I've been noticing very unusal access issues on the box. For example, I > > could not get to my webserver from one remote box using https. I had to > > change my rules before it would work: > > > > Here is the after and before. I had to replace the keep state with two > > rules (a.c.b.d is the IP address in question): > > > > < pass in quick proto tcp from a.b.c.d/32 to any port = https > > < pass out quick proto tcp from any to a.b.c.d/32 port = https > > --- > > > pass in quick proto tcp from a.b.c.d/32 to any port = https flags S keep state > > Could it be that this didn't actually fix your problem but that you made some > other change in the process? For example, did you flush your state table? Is it > possible that it was getting full? I agree with your theory. Thank you. After doing an ipf -FS to clear the state table, everything was still working fine. Then I reinstated my keep state rules and things went back to normal. Any suggestions to avoid this problem in future? Thanks. -- Dan Langille The FreeBSD Diary - http://freebsddiary.org/ - practical examples To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message