From owner-freebsd-pf@FreeBSD.ORG Tue Sep 9 16:35:26 2008 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 5249A1065677 for ; Tue, 9 Sep 2008 16:35:26 +0000 (UTC) (envelope-from ddesimone@verio.net) Received: from relay2-bcrtfl2.verio.net (relay2-bcrtfl2.verio.net [131.103.218.177]) by mx1.freebsd.org (Postfix) with ESMTP id 006018FC29 for ; Tue, 9 Sep 2008 16:35:25 +0000 (UTC) (envelope-from ddesimone@verio.net) Received: from iad-wprd-xchw01.corp.verio.net (iad-wprd-xchw01.corp.verio.net [198.87.7.164]) by relay2-bcrtfl2.verio.net (Postfix) with ESMTP id CE3461FF00BE for ; Tue, 9 Sep 2008 12:35:24 -0400 (EDT) thread-index: AckSmg9Cike0a4jmTIOgi9Q9R0pMyg== Received: from limbo.int.dllstx01.us.it.verio.net ([10.10.10.11]) by iad-wprd-xchw01.corp.verio.net with Microsoft SMTPSVC(6.0.3790.1830); Tue, 9 Sep 2008 12:35:24 -0400 Received: by limbo.int.dllstx01.us.it.verio.net (Postfix, from userid 1000) id A37E28E29B; Tue, 9 Sep 2008 11:35:18 -0500 (CDT) Date: Tue, 9 Sep 2008 11:35:18 -0500 From: "David DeSimone" Content-Transfer-Encoding: 7bit To: Message-ID: <20080909163518.GF4571@verio.net> Content-Class: urn:content-classes:message Mail-Followup-To: freebsd-pf@freebsd.org Importance: normal Priority: normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992 References: <9bc4ff5c0809080813t1c370b72pce80dfa64f91fa41@mail.gmail.com> <20080908180407.GB4100@verio.net> <20080908185035.GA76018@icarus.home.lan> <9bc4ff5c0809082220v42bd264dp21088a15d3eb6319@mail.gmail.com> <20080909061045.GA88034@icarus.home.lan> MIME-Version: 1.0 Content-Type: text/plain; x-action=pgp-signed; charset="us-ascii" Content-Disposition: inline In-reply-to: <20080909061045.GA88034@icarus.home.lan> Precedence: bulk User-Agent: Mutt/1.5.9i X-OriginalArrivalTime: 09 Sep 2008 16:35:24.0627 (UTC) FILETIME=[0F369A30:01C9129A] Subject: Re: FreeBSD 7.1-PRERELEASE Trouble X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Sep 2008 16:35:26 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Jeremy Chadwick wrote: > > > # pfctl -k 78.107.71.38 > > killed 1 states from 1 sources and 0 destinations > > # pfctl -s state|grep 78.107.71.38 > > all udp 195.14.50.21:53 -> 78.107.71.38:42859 MULTIPLE:MULTIPLE > Hmm, it appears that even with the "block" rule in place, and all > previous state table entries flushed, the packet is somehow making it > through. I know my reading comprehension on this thread hasn't been very good, but I'm going to try again. pfctl -k did kill a state, but it appears that a reply packet from 195.14.50.21 recreated a state entry, probably just bad timing. You should try killing the state again, perhaps with pfctl -k 195.14.50.21 -k 78.107.71.38 And maybe before that, add an extra block rule in the opposite direction to block replies, at least temporarily just to stop these state entries from being recreated. - -- David DeSimone == Network Admin == fox@verio.net "I don't like spinach, and I'm glad I don't, because if I liked it I'd eat it, and I just hate it." -- Clarence Darrow -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFIxqXFFSrKRjX5eCoRAqPGAJ9NuZHrFuridRMSDmLOIQlld0VfIACfX9Hx b5woCHBRpAu2wouD84vXqB8= =Pmof -----END PGP SIGNATURE----- This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio, Inc. makes no warranty that this email is error or virus free. Thank you.