From owner-freebsd-questions@FreeBSD.ORG Mon Oct 6 12:03:36 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id DE2671065687; Mon, 6 Oct 2008 12:03:36 +0000 (UTC) (envelope-from keramida@ceid.upatras.gr) Received: from igloo.linux.gr (igloo.linux.gr [62.1.205.36]) by mx1.freebsd.org (Postfix) with ESMTP id 3E0178FC21; Mon, 6 Oct 2008 12:03:35 +0000 (UTC) (envelope-from keramida@ceid.upatras.gr) Received: from kobe.laptop (adsl57-177.kln.forthnet.gr [77.49.184.177]) (authenticated bits=128) by igloo.linux.gr (8.14.3/8.14.3/Debian-5) with ESMTP id m96C2dD9001647 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Mon, 6 Oct 2008 15:02:44 +0300 Received: from kobe.laptop (kobe.laptop [127.0.0.1]) by kobe.laptop (8.14.3/8.14.3) with ESMTP id m96C2clu003489; Mon, 6 Oct 2008 15:02:38 +0300 (EEST) (envelope-from keramida@ceid.upatras.gr) Received: (from keramida@localhost) by kobe.laptop (8.14.3/8.14.3/Submit) id m96C2ccJ003488; Mon, 6 Oct 2008 15:02:38 +0300 (EEST) (envelope-from keramida@ceid.upatras.gr) From: Giorgos Keramidas To: Jeremy Chadwick References: <200810051753.m95Hr3N5014872@mp.cs.niu.edu> <20081006003601.GA5733@icarus.home.lan> <48E9BBED.7090607@infracaninophile.co.uk> <20081006072611.GA13147@icarus.home.lan> <871vyuj6ul.fsf@kobe.laptop> <20081006115101.GA19442@icarus.home.lan> Date: Mon, 06 Oct 2008 15:02:38 +0300 In-Reply-To: <20081006115101.GA19442@icarus.home.lan> (Jeremy Chadwick's message of "Mon, 6 Oct 2008 04:51:01 -0700") Message-ID: <87ej2uexsx.fsf@kobe.laptop> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/23.0.60 (berkeley-unix) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-MailScanner-ID: m96C2dD9001647 X-Hellug-MailScanner: Found to be clean X-Hellug-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=-3.858, required 5, autolearn=not spam, ALL_TRUSTED -1.80, AWL 0.54, BAYES_00 -2.60) X-Hellug-MailScanner-From: keramida@ceid.upatras.gr X-Spam-Status: No Cc: Scott Bennett , freebsd-questions@freebsd.org Subject: Re: pf vs. RST attack question X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Oct 2008 12:03:37 -0000 On Mon, 6 Oct 2008 04:51:01 -0700, Jeremy Chadwick wrote: >> I run my laptop with a `pf.conf' that (putting most of the comments and >> other disabled rules for one-off tests aside) looks pretty much like: >> >> set block-policy drop >> set require-order yes >> set skip on lo0 >> scrub in all >> block in all >> block out all >> pass in quick proto icmp all >> pass out quick proto icmp all >> pass out proto { tcp, udp } all keep state > > A couple things to point out here: > > First, ICMP rules coming first (especially with "quick") might not be > ideal; ICMP is often considered a "last resort" protocol, meaning TCP > and UDP packets should have priority over it. It all depends on what > you want, but this is often the industry norm. That's nice. > Second, and much more importantly, if you're on RELENG_7, "keep state" > serves no purpose here; "flags S/SA" is implicit on TCP rules, and > "keep state" is implicit in TCP, UDP, and ICMP rules. 8.0-CURRENT so `flags S/SA' is indeed implicit. I updated the rules to include `flags S/SA' too. Both this part and `keep state' are implicit now, but I like being slightly less verbose because I tend to forget what is `default' and what is not, at the expense of being slightly more verbose :) > Happy firewalling! :-) Thanks :)