Faulconer, Steven M. wrote:
pass in quick on dmfe0 proto tcp from any to <firewall> port = 80
pass in quick on dmfe0 proto udp from any to <firewall> port = 80
pass out quick on dmfe1 proto tcp from <webserver> to any port = 80
pass out quick on dmfe1 proto udp from <webserver> to any port = 80
block in all
block out all
This won't solve your problem, but you'll have a much more effecient
ruleset with this:
----------------------------
pass in quick on dmfe0 proto tcp/udp from any to <firewall> port =
80 keep state
block in all
block out all
----------------------------
Advantages:
- less rules
- more secure, it follows the state
- will allow any related ICMPs such as type 3/4 needed for Path MTU Discovery
What version of ipf allows PMTUD ICMP packets as part of keep state?
--
Randy
OS X - UNIX for the rest of us
NetBSD - Catch the Power!
