From owner-freebsd-pf@FreeBSD.ORG  Mon Aug  8 14:18:29 2005
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
X-Original-To: freebsd-pf@freebsd.org
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id CA46C16A41F
	for <freebsd-pf@freebsd.org>; Mon,  8 Aug 2005 14:18:29 +0000 (GMT)
	(envelope-from slapinid@gmail.com)
Received: from zproxy.gmail.com (zproxy.gmail.com [64.233.162.194])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 4D83743D46
	for <freebsd-pf@freebsd.org>; Mon,  8 Aug 2005 14:18:29 +0000 (GMT)
	(envelope-from slapinid@gmail.com)
Received: by zproxy.gmail.com with SMTP id z6so581962nzd
	for <freebsd-pf@freebsd.org>; Mon, 08 Aug 2005 07:18:28 -0700 (PDT)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com;
	h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=XAeu+Xt/n4Btil6pSnpkUFfnhsDfUQj6mmSzWSh1Qbh63nQgtzEi4DleShmICTxeE91ZhiYCidp6DAIkDe8ZFsnBCnT12328furRwNUiMbnBr/gX8/4wVhioOzkmz9iX95MGs0yiYpZ3fyrb6UKvO3wjzzqAKcv75jXWFjcE8s4=
Received: by 10.36.36.14 with SMTP id j14mr2640762nzj;
	Mon, 08 Aug 2005 07:18:28 -0700 (PDT)
Received: by 10.36.33.4 with HTTP; Mon, 8 Aug 2005 07:18:28 -0700 (PDT)
Message-ID: <48239d3905080807182fef6a5b@mail.gmail.com>
Date: Mon, 8 Aug 2005 18:18:28 +0400
From: Sergey Lapin <slapinid@gmail.com>
To: freebsd-pf@freebsd.org
In-Reply-To: <42F7502C.4070003@tirloni.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
References: <48239d390508040958265ce62@mail.gmail.com>
	<48239d3905080504297b3ebc89@mail.gmail.com>
	<200508060411.05482.max@love2party.net>
	<48239d390508080452270c8d10@mail.gmail.com>
	<42F7502C.4070003@tirloni.org>
Subject: Re: Fwd: pf problems
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 08 Aug 2005 14:18:29 -0000

>   I've the same situation here and we use route-to to route everything
> from ISP1's network to their gateway and vice-versa.
>=20
>   route-to re-routes a packet from 1.0.0.0/24 when it's trying to leave
> through the ISP2 interface and everything then gets NAT'ed properly.
>=20
>   pass out on $ext_isp2_if route-to ($ext_isp1_if $ext_isp1_gw) from
> $isp1_net to any
>=20
It does not help. Actually, it looks like pf does not have control
over outgoing packets produced by pf itself. I can not neither block
nor reroute these packets. I checked this very easily - I created a
rule

block out log quick from SOME_OUTSIDE_HOST/32 to any
block out log quick from any to SOME_OUTSIDE_HOST/32

and made it very first rules of the firewall. Needless to say, when I
tried to telnet to router port 9999 from SOME_OUTSIDE_HOST, tcpdump on
the pflog0 device got incoming SYN but did not show RST. From the
other hand, tcpdump on the default gateway interface shown outgoing
RST. Again, from this I conclude that pf-generated packets (RST/ICMP)
are not subject for ruleset processing.