Date: Fri, 22 Jan 2010 13:23:45 -0500 From: kalin m <kalin@el.net> To: "Jason V. Miller" <jmiller@securityfocus.com> Cc: freebsd-security@freebsd.org Subject: Re: pf rules Message-ID: <4B59ED31.10304@el.net> In-Reply-To: <20100122153545.GA23548@mail.securityfocus.com> References: <4B5958E2.9010509@el.net> <20100122153545.GA23548@mail.securityfocus.com>
next in thread | previous in thread | raw e-mail | index | archive | help
thanks... i was under the impression that if you have everything blocked the initial syn request will be ignored. it doesn't make sense otherwise.... Jason V. Miller wrote: > Others have already given some good feedback (and asked some good > questions), but: > > >> pass out all keep state >> > > You're allowing out the initial TCP SYN, and creating a state entry for the > connection here. You should be able to make outgoing connections anywhere > with this rule. > > Once a state entry gets created, the state table will match on the traffic > for the session, and the rules list won't have to be evaluated. > > J. > >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4B59ED31.10304>