From owner-freebsd-pf@FreeBSD.ORG Wed Nov 23 14:31:17 2005 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id AE82116A41F for ; Wed, 23 Nov 2005 14:31:17 +0000 (GMT) (envelope-from alextols@gmail.com) Received: from wproxy.gmail.com (wproxy.gmail.com [64.233.184.195]) by mx1.FreeBSD.org (Postfix) with ESMTP id 92E4C43D78 for ; Wed, 23 Nov 2005 14:31:13 +0000 (GMT) (envelope-from alextols@gmail.com) Received: by wproxy.gmail.com with SMTP id 69so1442359wri for ; Wed, 23 Nov 2005 06:31:12 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:subject:from:to:cc:in-reply-to:references:content-type:date:message-id:mime-version:x-mailer:content-transfer-encoding; b=kxSWWosfuBK2kIiYagYIKh+WCGe/lxlyJIUqfU7l8mTI4K0mqyjfhS/jDIiQJstzhFyQVa0Re9/I4afUO27aI8Mp+aWMO28cqC8AacaVAQWE3Jbihdn/zET9wdr2Amyh6dcT88KMt5IdYSDtUH+d1nw/HWKu4OI+znK38rGgWCI= Received: by 10.65.145.14 with SMTP id x14mr6111304qbn; Wed, 23 Nov 2005 06:31:12 -0800 (PST) Received: from ?10.21.50.3? ( [213.221.7.36]) by mx.gmail.com with ESMTP id d2sm364422qbc.2005.11.23.06.31.10; Wed, 23 Nov 2005 06:31:11 -0800 (PST) From: Alex To: Max Laier In-Reply-To: <200511231456.03507.max@love2party.net> References: <1132753339.649.48.camel@diablo> <200511231456.03507.max@love2party.net> Content-Type: text/plain; charset=KOI8-R Date: Wed, 23 Nov 2005 17:31:18 +0300 Message-Id: <1132756278.649.56.camel@diablo> Mime-Version: 1.0 X-Mailer: Evolution 2.2.3 FreeBSD GNOME Team Port Content-Transfer-Encoding: 8bit Cc: freebsd-pf@freebsd.org Subject: Re: pf synproxy in 6.0 X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Nov 2005 14:31:17 -0000 В ср, 23/11/2005 в 14:55 +0100, Max Laier пишет: > On Wednesday 23 November 2005 14:42, Alex wrote: > > In contrast, looks like synproxy is _not_ working in 6-stable from > > November, 22nd. > > The same ruleset for inbound traffic is working successfully on > > 5.4-STABLE. > > The workaround I've done is a change 'synproxy' option to 'modulate' > > Any ideas and info? > > There has been a change in how synproxy works. With OpenBSD's revision 1.437 > of pf.c: http://www.openbsd.org/cgi-bin/cvsweb/src/sys/net/pf.c#rev1.437 the > secondary handshake no longer passes unconditionally, but must be allowed by > a separate rule. Something like: > > pass on $int_if proto tcp from any to $synproxied flags S/SA > > should do. Can you please check and confirm? I am afraid this difference in > behavior from normal "keep/modulate" vs. "synproxy" is underdocumented - > suggestions appreciated. Unfortunately I've got only 1 NIC on machine and requested service is running on the same FreeBSD box. Here's my ruleset : ext_if="vr0" pass in quick on $ext_if proto icmp from any to $ext_if icmp-type echoreq pass in quick on $ext_if proto icmp from any to $ext_if icmp-type echorep pass out quick on $ext_if proto icmp from $ext_if to any icmp-type echoreq pass out quick on $ext_if proto icmp from $ext_if to any icmp-type echorep block in quick on $ext_if proto icmp from any to any block out quick on $ext_if proto icmp from any to any pass quick on lo0 all pass in log quick on $ext_if proto tcp from any to $ext_if port { ssh, smtp, pop3 } flags S/SA synproxy state pass out quick on $ext_if proto tcp all modulate state flags S/SA pass out quick on $ext_if proto udp all keep state block in log on $ext_if What's to be added to take synproxy into working state? -- Alex