On Tue, Jul 04, 2023 at 10:42:39AM -0600, Zack Newman wrote:
> ...
> I am guessing you didn't flush the rules after disabling pf since
> clearly pf rules are still being used. Run pfctl -F all after disabling
> pf. Run pfctl -s all to verify there are no active rules.
Hi,
I see that I was not clear enough.
My question is not about how to disable pf, but rather why the packets
are see as "in" when coming from my own address, and, why they are
blocked i.e.
I noticed these block messages being logged when I click "discover/refresh" in
simple-scan:
Jul 04 11:23:44.601042 rule 2/(match) block in on em0: 192.168.178.11.8612 >
192.168.178.255.8612: udp 16
Jul 04 11:23:44.601051 rule 2/(match) block in on em0: 192.168.178.11.8612 >
192.168.178.255.8610: udp 16
Jul 04 11:23:44.615516 rule 2/(match) block in on em0: 192.168.178.11.8612 >
192.168.178.255.8612: udp 16
Jul 04 11:23:44.615523 rule 2/(match) block in on em0: 192.168.178.11.8612 >
192.168.178.255.8610: udp 16
Jul 04 11:23:45.147239 rule 2/(match) block in on em0: 192.168.178.11.9609 >
255.255.255.255.3289: udp 15 [ttl 1]
Jul 04 11:23:46.155868 rule 2/(match) block in on em0: 192.168.178.11.39413 >
255.255.255.255.1124: udp 37 [ttl 1]
192.168.178.11 is my OpenBSD desktop (where of is running).
I don't understand what I'm seeing here ...
1. Why am I seeing traffic coming _in_ from my own address? Is that not
slightly weird? Is it because it is _to_ the .255 broadcast address?
2. And why is it being blocked? Do I have explicitly allow broadcast
traffic e.g. with rules to handle broadcast addresses? I don't think
I ever considered doing that before ...
The more I use pf, the less I seem to understand?
Danke im Voraus!
Robb.
