From owner-freebsd-stable Thu Mar 14 9:30:46 2002 Delivered-To: freebsd-stable@freebsd.org Received: from shemp.palomine.net (shemp.palomine.net [216.135.64.135]) by hub.freebsd.org (Postfix) with SMTP id 96E3837B400 for ; Thu, 14 Mar 2002 09:30:39 -0800 (PST) Received: (qmail 43730 invoked by uid 1000); 14 Mar 2002 17:30:38 -0000 Date: Thu, 14 Mar 2002 12:30:38 -0500 From: Chris Johnson To: Dan Langille Cc: freebsd-stable@FreeBSD.ORG Subject: Re: ipfilter keep state broken? Message-ID: <20020314123038.B43330@palomine.net> References: <20020314164723.4E1543F0E@bast.unixathome.org>; <20020314121048.A43100@palomine.net> <20020314172627.DEF953F0E@bast.unixathome.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="dc+cDN39EJAMEtIO" Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <20020314172627.DEF953F0E@bast.unixathome.org>; from dan@langille.org on Thu, Mar 14, 2002 at 12:26:27PM -0500 Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG --dc+cDN39EJAMEtIO Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Mar 14, 2002 at 12:26:27PM -0500, Dan Langille wrote: > On 14 Mar 2002 at 12:10, Chris Johnson wrote: >=20 > > On Thu, Mar 14, 2002 at 11:47:21AM -0500, Dan Langille wrote: > > > I upgraded my webserver on March 9 from the post 4.5-RELASE stable. = Today=20 > > > I've been noticing very unusal access issues on the box. For example= , I=20 > > > could not get to my webserver from one remote box using https. I had= to=20 > > > change my rules before it would work: > > >=20 > > > Here is the after and before. I had to replace the keep state with t= wo=20 > > > rules (a.c.b.d is the IP address in question): > > >=20 > > > < pass in quick proto tcp from a.b.c.d/32 to any port =3D https > > > < pass out quick proto tcp from any to a.b.c.d/32 port =3D https > > > --- > > > > pass in quick proto tcp from a.b.c.d/32 to any port =3D https flag= s S keep state > >=20 > > Could it be that this didn't actually fix your problem but that you mad= e some > > other change in the process? For example, did you flush your state tabl= e? Is it > > possible that it was getting full? >=20 > I agree with your theory. Thank you. >=20 > After doing an ipf -FS to clear the state table, everything was still=20 > working fine. Then I reinstated my keep state rules and things went back= =20 > to normal. >=20 > Any suggestions to avoid this problem in future? Thanks. Do all of the "pass...proto tcp...keep state" lines in your rules file incl= ude "flags S"? I recently had a similar problem caused by my leaving out flags = S on a tcp keep state rule. Chris --dc+cDN39EJAMEtIO Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: For info see http://www.gnupg.org iD8DBQE8kN49yeUEMvtGLWERAhv7AKDvPAjJEqXpnw+ASnEH0lyR0HNLBgCgwBjo FrpWcrSy/sDJIhmKyv+ikgs= =69El -----END PGP SIGNATURE----- --dc+cDN39EJAMEtIO-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message