About pf states

2007-01-16 Thread Samuel Moñux
Hello everyone, I'm trying to replace a crufty pf.conf which has evolved badly, and I think doesn't fully uses the stateful capabilities of pf. The problem is that there must be something I don't really understand about states. My plan was to write a pf.conf with almost no "out" clauses. A packe

Re: About pf states

2007-01-17 Thread Brian Candler
On Tue, Jan 16, 2007 at 08:03:52PM +0100, Samuel Mo?ux wrote: > With this config, I can't access "dmz hosts" from lan or internet. The > state gets created: > > all tcp $dmz_ip:25 <- 192.168.1.161:19399 CLOSED:SYN_SENT > > but the response is blocked: > > Jan 16 19:32:59.627083 rule 0/(mat

Re: About pf states

2007-01-17 Thread Samuel Moñux
2007/1/17, Brian Candler <[EMAIL PROTECTED]>: Someone please correct me if I'm wrong, but I believe that the 'keep state' only applies to the opposite packets through the same interface. For example: pkt1++ pkt1' ---> | ext_if int_if | --> <--- |

Re: About pf states

2007-01-18 Thread Brian Candler
On Wed, Jan 17, 2007 at 02:29:13PM +0100, Samuel Mo?ux wrote: > every state is a [src, dst, direction] tuple > which lets pass [src -> dst, direction ] and [dst -> src, > not(direction)], but not [ src-> dst, not(direction) ] packets. Very clear - I think that description should go into pf.conf(5)

Re: About pf states

2007-05-17 Thread Brian A. Seklecki
I just ran into this same problem. Trying to accomplish Cisco ASA style reflexive stateful rules(r): - Default block in - Trust no subnets / interface - Pass in rules which ingress/egress an interface pair - Inbound tcp syn on any interface shoud create relfexsive outbound equivilant on the e