Date: Fri, 22 Jan 2010 08:35:45 -0700 From: "Jason V. Miller" <jmiller@securityfocus.com> To: kalin m <kalin@el.net> Cc: freebsd-security@freebsd.org Subject: Re: pf rules Message-ID: <20100122153545.GA23548@mail.securityfocus.com> In-Reply-To: <4B5958E2.9010509@el.net> References: <4B5958E2.9010509@el.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Others have already given some good feedback (and asked some good questions), but: > pass out all keep state You're allowing out the initial TCP SYN, and creating a state entry for the connection here. You should be able to make outgoing connections anywhere with this rule. Once a state entry gets created, the state table will match on the traffic for the session, and the rules list won't have to be evaluated. J. -- Jason V. Miller
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20100122153545.GA23548>