Il 23/07/2012 11:55, Daniel Hartmeier ha scritto:
On Mon, Jul 23, 2012 at 11:37:27AM +0200, Tonix (Antonio Nati) wrote:
What it is not clear to me is related to in/out rules evaluation.
Diagram starts obviously from the packet entering the system, until the
packet exits the system. When the packet enters the system, which rules
are evaluated? All rules related to interface, both for IN and OUT? Or
only IN?
During both phases (first incoming on one interface, then outgoing on
the other interface), all rules are evaluated.
Rules can omit the direction (e.g. 'pass from src to dst'), and such
rules can match in either phase, or both.
If rules do specify a direction (e.g. 'pass in from src to dst'), they are
still evaluated during both in and out phase, but they cannot possibly
match during the wrong phase.
Daniel,
thanks for the detailed explanation.
So, does that mean the OUT phase evaluation always occurs when IN phase
has been positive (packet should pass)?
I'm thinking to management of a lot of interfaces, where one is the WAN,
and others are DMZ and/or customers dedicated subnets.
I'd love to put basic protections on WAN input, and then permit all
other interfaces to define its own rules for packets coming/going
from/to the specific subnet.
According to what I understand of your explanation, each interface could
have its own IN rules, and if the IN rules of a specific INPUT interface
are successfull, the OUT rules of the 'outgoing' interface are then
evaluated.
This would be wonderful, as each interface could have both IN and OUT
rules which do not interphere with or break other interfaces rules. And
would permit to write the most of rules just once, according to each
interface needs.
Regards,
Tonino
PF manual says all rules in pf.conf are evaluated, so I suppose all
rules applying to that interface are evaluated... or only IN rules are
evaluated in this first step, and only OUT rules are evaluated in second
step?
There isn't really any difference: while all rules are evaluated, only
the IN rules can possibly match (in the first step), so there's no way
you notice the OUT rules are being evaluated...
Daniel
--
------------------------------------------------------------
Inter@zioni Interazioni di Antonio Nati
http://www.interazioni.it [email protected]
------------------------------------------------------------
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to "[email protected]"
