On Wednesday 19 September 2007, Abdullah Ibn Hamad Al-Marri wrote: > Hello Guys, > > Here are my full rules. > > When I pfctl -e or pfctl -d all connections will die.
... "rules with synproxy state" > Do you know the cause? see above. Using "synproxy state" causes pf to complete the 3WHS before contacting the other endpoint, hence it has to translate all future sequence numbers for this connection. If you disable pf, the translation goes away and the connection dies. The same thing happens if you use "modulate state". For the "pfctl -e" case: The pf in CURRENT uses "keep state flags S/SA" by default for any tcp pass rule. That means that it will only match on the initial SYN that starts the connection. The rest of the connection is then passed based on the state entry. Consequently any pre-existing connection will not have a state entry and be blocked. -- /"\ Best regards, | [EMAIL PROTECTED] \ / Max Laier | ICQ #67774661 X http://pf4freebsd.love2party.net/ | [EMAIL PROTECTED] / \ ASCII Ribbon Campaign | Against HTML Mail and News
signature.asc
Description: This is a digitally signed message part.
