From owner-freebsd-pf@FreeBSD.ORG Wed Mar 26 16:20:45 2008 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 88BD51065676 for ; Wed, 26 Mar 2008 16:20:45 +0000 (UTC) (envelope-from dalibor.gudzic@gmail.com) Received: from ti-out-0910.google.com (ti-out-0910.google.com [209.85.142.184]) by mx1.freebsd.org (Postfix) with ESMTP id 0E31B8FC19 for ; Wed, 26 Mar 2008 16:20:44 +0000 (UTC) (envelope-from dalibor.gudzic@gmail.com) Received: by ti-out-0910.google.com with SMTP id j2so1299957tid.3 for ; Wed, 26 Mar 2008 09:20:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:references; bh=NrcS8Ge2SY97Cgib2iJLiRr/yU00f1/al4ZxGBInjyE=; b=Uw+znPlOypt7tMpa+LpEcZX8Nyg+SSZj/s32H9ubzcifjGoXYPLH+kTrRXxug+8n0y+MYfeNdT0wCzC1cZfs8YBV8elrrJcyojUHn1bMP8kejcj+TKzg+GSWCh7Ji9O2L1uYPTNiviKijoxL/cuVfqYKEkdHRHfuMD7CdumW8fA= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:references; b=gEdXba4wBEJ8p3Z6q5oE0gH99mbcomd+jIM/VE+Kf6qZ44m8yy+cdSKQd/+CefvvA0bPoZ4Bv4BxieBJo3/r1MzA0+l7iYZY1v+bcm5Sbrta2JSxVDvMdGTpHc0/rpVY12Cts+z++l4MPRDFF9XXp0HHZ7IqXK8znKXA0ksDOAk= Received: by 10.151.103.11 with SMTP id f11mr110821ybm.194.1206548441736; Wed, 26 Mar 2008 09:20:41 -0700 (PDT) Received: by 10.150.228.11 with HTTP; Wed, 26 Mar 2008 09:20:41 -0700 (PDT) Message-ID: <866fa9520803260920s61c09e54v398be6cf0312a90b@mail.gmail.com> Date: Wed, 26 Mar 2008 17:20:41 +0100 From: "Dalibor Gudzic" To: "Jeremy Chadwick" In-Reply-To: <20080326154217.GA87250@eos.sc1.parodius.com> MIME-Version: 1.0 References: <9DE6EC5B5CF8C84281AE3D7454376A0D6D0290@cetus.dawnsign.com> <20080326025316.GA68607@eos.sc1.parodius.com> <866fa9520803260802v3686b24dq1ee7aa1cc4b35f75@mail.gmail.com> <20080326154217.GA87250@eos.sc1.parodius.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Cc: freebsd-pf@freebsd.org Subject: Re: Bacula File/Storage Connection Woes using PF X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Mar 2008 16:20:45 -0000 On Wed, Mar 26, 2008 at 4:42 PM, Jeremy Chadwick wrote: > > Now the opposite, where some host on the Internet attempts to connect to > 4.4.4.4 on port 22: > > somehost -> pfbox = TCP flags SYN set, ACK not set > = PASS: matches rule #4 > pfbox -> somehost = TCP flags: SYN set, ACK set > = PASS: matches rule #2 > somehost -> pfbox = TCP flags SYN not set, ACK set > = PASS: matches rule #4 > > A state-table entry won't be created for this one, since rule #1 > specifies "flags S/SA" (won't match SYN+ACK both set). > > If one was to add "keep state" to rule #4 (RELENG_6), or use RELENG_7 > (where "keep state" is implied) and some host on the Internet attempts > to connect to 4.4.4.4 on port 22, we should see: > > somehost -> pfbox = TCP flags SYN set, ACK not set > = PASS: matches rule #4 > = pf creates state-table entry for tracking > pfbox -> somehost = TCP flags: SYN set, ACK set > = PASS: has state-table entry > somehost -> pfbox = TCP flags SYN not set, ACK set > = PASS: has state-table entry > > Do we agree? > > -- > | Jeremy Chadwick jdc at parodius.com | > | Parodius Networking http://www.parodius.com/ | > | UNIX Systems Administrator Mountain View, CA, USA | > | Making life hard for others since 1977. PGP: 4BD6C0CB | > > Seems to be OK now. Sorry, I should have made it more clearer in the previous message; I meant, and should've said, "SYN-ACK" i.e. the response packet from host.