Date: Fri, 09 Aug 2024 08:34:27 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 280701] FreeBSD-SA-24:05 fix breaks ICMP/ICMP6 (ping, tracertoute) states handling in pf firewall Message-ID: <bug-280701-227@https.bugs.freebsd.org/bugzilla/>
index | next in thread | raw e-mail
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=280701 Bug ID: 280701 Summary: FreeBSD-SA-24:05 fix breaks ICMP/ICMP6 (ping, tracertoute) states handling in pf firewall Product: Base System Version: 14.1-RELEASE Hardware: Any OS: Any Status: New Severity: Affects Some People Priority: --- Component: kern Assignee: bugs@FreeBSD.org Reporter: doktornotor@mailinator.com On systems with the FreeBSD-SA-24:05 fix [1] applied and pf firewall enabled, replies to ping initiated from machines on networks behind pf firewall/NAT to anything outside the local networks get blocked (state violation), resulting in 'Request timed out'. - Reverting the security "fix" fixes the issue. - Disabling pf completely (pfctl -d) mitigates the issue. - For IPv4, permitting ICMP time exceeded in addition to echo reply does not help either (NAT state is missing). [1] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:05.pf.asc -- You are receiving this mail because: You are the assignee for the bug.home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-280701-227>