Date: Thu, 28 Feb 2008 07:31:06 +0100 From: Daniel Hartmeier <daniel@benzedrine.cx> To: Vadym Chepkov <vchepkov@gmail.com> Cc: freebsd-pf@freebsd.org Subject: Re: floating keep state Message-ID: <20080228063105.GC32592@insomnia.benzedrine.cx> In-Reply-To: <1635d77d0802272002w6aaaa0ect164a64e136b969f5@mail.gmail.com> References: <1635d77d0802271143u2aeb0b13we310ea1a611afaa8@mail.gmail.com> <6e6841490802271310o3e5976a4gef2cb507087c01b@mail.gmail.com> <1635d77d0802271346g4cf02b8et8bc74d16f6e97e45@mail.gmail.com> <1635d77d0802272002w6aaaa0ect164a64e136b969f5@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Feb 27, 2008 at 11:02:08PM -0500, Vadym Chepkov wrote: > My question is, why the reply packet was blocked? It seems you're misunderstanding what 'floating state' means. It does NOT mean "allow connection on all interfaces". If a connection traverses two interfaces, you need to allow it on both, creating two two separate state entries (one incoming, one outgoing). The 'floating' would come into play if you had more than two interfaces, and the same connection would traverse all three of them, due to dynamic routing. Without dynamic routing, you can pretty much forget about floating states, they do nothing. The first problem in your ruleset is that it does not block by default. Instead, the packet goes out through xl0 based on the implicit pass rule and does not create a second state. When the reply comes back in on xl0, there is no matching state (the first one created on xl1 does NOT match, as direction is reversed), and no pass rule matches on that interface in this direction. Hence the block. Add a default block, add a 'pass out ... keep state' rule, and it will work. You probably thought floating states would do that, but they don't. Daniel
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20080228063105.GC32592>