https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=280701
Bug ID: 280701
Summary: FreeBSD-SA-24:05 fix breaks ICMP/ICMP6 (ping,
tracertoute) states handling in pf firewall
Product: Base System
Version: 14.1-RELEASE
Hardware: Any
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: kern
Assignee: [email protected]
Reporter: [email protected]
On systems with the FreeBSD-SA-24:05 fix [1] applied and pf firewall enabled,
replies to ping initiated from machines on networks behind pf firewall/NAT to
anything outside the local networks get blocked (state violation), resulting in
'Request timed out'.
- Reverting the security "fix" fixes the issue.
- Disabling pf completely (pfctl -d) mitigates the issue.
- For IPv4, permitting ICMP time exceeded in addition to echo reply does not
help either (NAT state is missing).
[1] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:05.pf.asc
--
You are receiving this mail because:
You are the assignee for the bug.
