On Wednesday 19 September 2007, Abdullah Ibn Hamad Al-Marri wrote:
> Hello Guys,
>
> Here are my full rules.
>
> When I pfctl -e or pfctl -d all connections will die.

... "rules with synproxy state"

> Do you know the cause?

see above.  Using "synproxy state" causes pf to complete the 3WHS before 
contacting the other endpoint, hence it has to translate all future 
sequence numbers for this connection.  If you disable pf, the translation 
goes away and the connection dies.  The same thing happens if you 
use "modulate state".

For the "pfctl -e" case:  The pf in CURRENT uses "keep state flags S/SA" 
by default for any tcp pass rule.  That means that it will only match on 
the initial SYN that starts the connection.  The rest of the connection 
is then passed based on the state entry.  Consequently any pre-existing 
connection will not have a state entry and be blocked.

-- 
/"\  Best regards,                      | [EMAIL PROTECTED]
\ /  Max Laier                          | ICQ #67774661
 X   http://pf4freebsd.love2party.net/  | [EMAIL PROTECTED]
/ \  ASCII Ribbon Campaign              | Against HTML Mail and News

Attachment: signature.asc
Description: This is a digitally signed message part.

Reply via email to