keep state fixed it thanks everyone!
ArkanoiD wrote: > nuqneH, > > You may just keep state. > > On Thu, May 11, 2006 at 03:45:24PM -0300, Scott Walker wrote: >> block in proto icmp all >> pass in quick on fxp0 proto icmp from any to any icmp-type echo >> pass in quick on fxp0 proto icmp from any to any icmp-type echorep >> pass in quick on xl0 proto icmp from any to any icmp-type echo >> pass in quick on xl0 proto icmp from any to any icmp-type echorep >> pass in quick on tun0 proto icmp from any to any icmp-type echo >> pass in quick on tun0 proto icmp from any to any icmp-type echorep >> >> Should the above rules allow me to ping across networks? The FW itself >> can ping all the hosts on both sides, but for example hosts strung off >> the tun0 VPN tunnel can't ping the FW, hosts on xl0 (internal lan) can't >> ping the FW or hosts on the VPN. >> >> Am I missing something? This seems pretty simple to do.
