On 05Apr2013 08:45, Daniel Hartmeier <dan...@benzedrine.cx> wrote:
| If you need NAT, you have to do that on the external interface, and it
| requires (implies, even) creating states.

I was imagining NATing on an internal virtual interface to a private
address on some kind of internal virtual interface; this might keep
the necessary state without being the outmost layer.

And then to do stateless filtering of RSTs on the real physical
external interface (because the NAT states are not present there,
or even if floating, will not match), and then have some kind of
stateless binat or other rewrite of the remaining non-RST packets
from the real external address to the private address used for the

| However, you can filter statelessly on the internal interface (the
| states won't match there (wrong direction, if-bound), dropping outgoing
| TCP RST, passing everything else.

Won't the RST packets shut down the TCP states as they traverse to
external interface?

I'd be happy to filter the RSTs as they exit the internal interface
as you suggest; I didn't think it would work because PF will track
the state implied by the RSTs as they enter on the external interface,
and presumably start rejecting regular traffic anyway.

Am I wrong here? (I'll try it anyway, it would be nice if it worked.)

I'd considered making the states if-bound earlier but further thought
suggested it wouldn't do me any good. But as you say, if the states
are on the external interface I would then have a free hand internally.

| Sounds similar to what was done to ignore the great firewall of China,
| see http://www.cl.cam.ac.uk/~rnc1/ignoring.pdf :)

Sounds almost identical to what they did there! Thanks for the paper;
an interesting read.

Cameron Simpson <c...@zip.com.au>

I thought back to other headaches from my past and sneered at their
ineffectiveness.        - Harry Harrison

Reply via email to