Date: Tue, 3 Dec 2019 10:26:09 +0100 From: =?UTF-8?Q?Morgan_Wesstr=c3=b6m?= <freebsd-database@pp.dyndns.biz> To: freebsd-pf@freebsd.org Subject: Re: pf's states Message-ID: <aefb012b-970d-9c64-4f5d-31133b2b68ce@pp.dyndns.biz> In-Reply-To: <20191203034903.GA33853@admin.sibptus.ru> References: <20191202025642.GA99174@admin.sibptus.ru> <7a5b77d9-29d2-4fb4-b82c-3e6a194baf6e@tuxpowered.net> <20191202152543.GA16128@admin.sibptus.ru> <c17233fd-e9df-81cc-e015-89f4d5715273@pp.dyndns.biz> <20191203034903.GA33853@admin.sibptus.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
> Do you mean to say that a state checks not only address:port pairs, but > also TCP flags? This is a new notion for me. What would be a "pass" rule > to create a "catch all" state with no regard for TCP flags? For TCP it checks the flags when the state is created. From man pf.conf flags <a> /<b> | /<b> | any This rule only applies to TCP packets that have the flags <a> set out of set <b>. Flags not specified in <b> are ignored. For stateful connections, the default is flags S/SA. To indicate that flags should not be checked at all, specify flags any. The flags are: (F)IN, (S)YN, (R)ST, (P)USH, (A)CK, (U)RG, (E)CE, and C(W)R. > >> Afaik a pass rule only creates state on the interface it >> monitors. > > I'm afraid this is an incorrect assumption. > >> I did not recreate your setup to check this though. But this >> is what should happen: >> >> With rule 2 remarked: >> >> - Your initial telnet SYN will create state on $inside through rule 3. >> - There should be no state created on $dmz. > > I'm afraid this is an incorrect assumption. According to man pf.conf, by > default "state-policy=floating" and state is not bound to interfaces. > The output of "pfctl -s state" does not indicate any interfaces either, > just protocols, addresses and ports. > This is weird. My state tables clearly shows the interface name first on the line instead of "all" but I use state-policy if-bound. I have no experience with floating mode, thus my assumptions earlier. I apologize if I was wrong. /Morgan
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?aefb012b-970d-9c64-4f5d-31133b2b68ce>