Date: Fri, 9 Nov 2007 17:47:27 +0100 From: Max Laier <max@love2party.net> To: Dag-Erling =?iso-8859-1?q?Sm=F8rgrav?= <des@des.no> Cc: freebsd-net@freebsd.org, dhartmei@freebsd.org Subject: Re: pf misfeature Message-ID: <200711091747.37523.max@love2party.net> In-Reply-To: <86y7d7k6m6.fsf@ds4.des.no> References: <86zlxoblmj.fsf@ds4.des.no> <200711090059.54990.max@love2party.net> <86y7d7k6m6.fsf@ds4.des.no>
next in thread | previous in thread | raw e-mail | index | archive | help
--nextPart4393533.MPXJtRLKbN Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Friday 09 November 2007, Dag-Erling Sm=C3=B8rgrav wrote: > Max Laier <max@love2party.net> writes: > > No, I don't see why these two should behave differently, but you > > should add a "scrub in on sk0" in any case. > > scrub is known and documented to interfere with NFS. Only with broken NFS clients and even then a combination of "no-df"=20 and "random-id" parameters can be used to make them work, too. Without=20 reassembly stateful filtering is impossible (though this still doesn't=20 explain why an explicit "udp keep state"-rule would work). =2D-=20 /"\ Best regards, | mlaier@freebsd.org \ / Max Laier | ICQ #67774661 X http://pf4freebsd.love2party.net/ | mlaier@EFnet / \ ASCII Ribbon Campaign | Against HTML Mail and News --nextPart4393533.MPXJtRLKbN Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4 (FreeBSD) iD8DBQBHNI8pXyyEoT62BG0RAtSNAJ9fVIKW6ExTL52yd8yvhxtTa1+3VgCfYj4Y FlsDPE/O/+FJKeTPLE0rUPw= =ivD3 -----END PGP SIGNATURE----- --nextPart4393533.MPXJtRLKbN--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200711091747.37523.max>