From owner-freebsd-stable  Thu Mar 14  9:40: 1 2002
Delivered-To: freebsd-stable@freebsd.org
Received: from bast.unixathome.org (bast.unixathome.org [216.187.105.150])
	by hub.freebsd.org (Postfix) with ESMTP id 0BD0E37B417
	for <freebsd-stable@FreeBSD.ORG>; Thu, 14 Mar 2002 09:39:56 -0800 (PST)
Received: from wocker (wocker.unixathome.org [192.168.0.99])
	by bast.unixathome.org (Postfix) with ESMTP
	id E80F93F0E; Thu, 14 Mar 2002 12:39:54 -0500 (EST)
From: "Dan Langille" <dan@langille.org>
Organization: DVL Software Limited
To: Chris Johnson <cjohnson@palomine.net>
Date: Thu, 14 Mar 2002 12:39:54 -0500
MIME-Version: 1.0
Subject: Re: ipfilter keep state broken?
Reply-To: dan@langille.org
Cc: freebsd-stable@FreeBSD.ORG
In-reply-to: <20020314123038.B43330@palomine.net>
References: <20020314172627.DEF953F0E@bast.unixathome.org>; from dan@langille.org on Thu, Mar 14, 2002 at 12:26:27PM -0500
X-mailer: Pegasus Mail for Windows (v4.01)
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Content-description: Mail message body
Message-Id: <20020314173954.E80F93F0E@bast.unixathome.org>
Sender: owner-freebsd-stable@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-stable.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-stable>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-stable>
X-Loop: FreeBSD.ORG

On 14 Mar 2002 at 12:30, Chris Johnson wrote:

> On Thu, Mar 14, 2002 at 12:26:27PM -0500, Dan Langille wrote:
>
> > After doing an ipf -FS to clear the state table, everything was still 
> > working fine.  Then I reinstated my keep state rules and things went back 
> > to normal.
> > 
> > Any suggestions to avoid this problem in future?  Thanks.
> 
> Do all of the "pass...proto tcp...keep state" lines in your rules file include
> "flags S"? I recently had a similar problem caused by my leaving out flags S on
> a tcp keep state rule.

It's mixed.  Some don't have flags, some have "flags S keep state" and 
other have "flags S/SA keep state".
-- 
Dan Langille
The FreeBSD Diary - http://freebsddiary.org/ - practical examples


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message