From owner-freebsd-pf@FreeBSD.ORG  Wed Mar 28 19:59:01 2007
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
X-Original-To: freebsd-pf@freebsd.org
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 0CD5616A400
	for <freebsd-pf@freebsd.org>; Wed, 28 Mar 2007 19:59:01 +0000 (UTC)
	(envelope-from Greg.Hennessy@nviz.net)
Received: from smtp.nildram.co.uk (smtp.nildram.co.uk [195.112.4.54])
	by mx1.freebsd.org (Postfix) with ESMTP id C7A3F13C48C
	for <freebsd-pf@freebsd.org>; Wed, 28 Mar 2007 19:59:00 +0000 (UTC)
	(envelope-from Greg.Hennessy@nviz.net)
Received: from gw2.local.net (unknown [62.3.210.251])
	by smtp.nildram.co.uk (Postfix) with ESMTP id F0F082BD051
	for <freebsd-pf@freebsd.org>; Wed, 28 Mar 2007 20:58:53 +0100 (BST)
From: "Greg Hennessy" <Greg.Hennessy@nviz.net>
To: "'Drew Tomlinson'" <drew@mykitchentable.net>,
	<freebsd-pf@freebsd.org>
References: <460AA59C.2000704@mykitchentable.net>
In-Reply-To: <460AA59C.2000704@mykitchentable.net>
Date: Wed, 28 Mar 2007 20:58:52 +0100
Message-ID: <000301c77173$8265dd00$87319700$@Hennessy@nviz.net>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: AcdxYw5cABzBj6GfSGeIqvVdj/7DqQADveDA
Content-Language: en-gb
X-Antivirus: avast! (VPS 000728-2, 28/03/2007), Outbound message
X-Antivirus-Status: Clean
Cc: 
Subject: RE: Why Does This Packet Match This Rule?
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 28 Mar 2007 19:59:01 -0000


> (and the rest).  What am I missing?

>From the rule snippets posted, 'keep state' & 'keep state flags S/SA' comes
to mind. 

You should endeavour to keep state on each and every rule and only establish
tcp state on the 3 way handshake. 

> 
> If it helps, I also posted my complete pf.conf and the rules to which
> it
> expands at http://drew.mykitchentable.net/Temp/pf.conf.htm

Not seeing this, connection times out. 

What exactly are you trying to do with what looks like a SoHo policy
expanding into > 80 rules ? 



Greg