Re: About pf states

2007-05-17 Thread Brian A. Seklecki
I just ran into this same problem. Trying to accomplish Cisco ASA style reflexive stateful rules(r): - Default block in - Trust no subnets / interface - Pass in rules which ingress/egress an interface pair - Inbound tcp syn on any interface shoud create relfexsive outbound equivilant on the

Re: About pf states

2007-01-18 Thread Brian Candler
On Wed, Jan 17, 2007 at 02:29:13PM +0100, Samuel Mo?ux wrote: every state is a [src, dst, direction] tuple which lets pass [src - dst, direction ] and [dst - src, not(direction)], but not [ src- dst, not(direction) ] packets. Very clear - I think that description should go into pf.conf(5)

Re: About pf states

2007-01-17 Thread Brian Candler
On Tue, Jan 16, 2007 at 08:03:52PM +0100, Samuel Mo?ux wrote: With this config, I can't access dmz hosts from lan or internet. The state gets created: all tcp $dmz_ip:25 - 192.168.1.161:19399 CLOSED:SYN_SENT but the response is blocked: Jan 16 19:32:59.627083 rule 0/(match) block

Re: About pf states

2007-01-17 Thread Samuel Moñux
2007/1/17, Brian Candler [EMAIL PROTECTED]: Someone please correct me if I'm wrong, but I believe that the 'keep state' only applies to the opposite packets through the same interface. For example: pkt1++ pkt1' --- | ext_if int_if | -- --- |