On Tuesday, Jul 22, 2003, at 15:27 US/Pacific, Alejandro G. Belluscio wrote:

Basically, I think he refers to the use of 'flags' as being no effective to block attacks. I don't think he refers to stateful filtering. Which are very related but don't need to actually be used together (think).

Depends on what you're doing and why. If you use "modulate state", "flags S/SA" is recommended to avoid strange behavior between two hosts with existing connections when the firewall is restarted. Beyond that, the combination doesn't seem to have much practical use.


http://marc.theaimsgroup.com/?l=openbsd-pf&m=103962333222121&w=2

The scrub code deals with these (and a few other combinations). If you're scrubbing and need to know if a packet is initiating a connection, S/SA is all you need to check. Explicit block rules aren't necessary for avoiding bogus traffic.


Reply via email to