Hi all,
Question: Is it a necessity to allow the TCP ACK flag for www traffic {80,443} ?
In my packet filtering rules I have explicitly masked the following flags:
FSRA
And am filtering for only SYN flags. i.e. S/FSRA.
However, I am seeing the following in my logs:
rule 5/0(match): pass in on wi0: 10.0.0.30.36280 > 194.159.245.16.80:
S 1477848336:1477848336(0) win 16384 <mss 1460,nop,nop,sackOK,[|tcp]>
(DF)
rule 1/0(match): block in on tun0: 194.159.245.16.80 >
10.0.0.30.36280: S 57021312:57021312(0) ack 1477848337 win 5840 <mss
1420,nop,nop,sackOK>
These are the rules I have for www traffic:
pass in log quick on wi0 inet proto tcp from 10.0.0.0/24 to any port =
www flags S/FSRA keep state label "80"
pass in log quick on wi0 inet proto tcp from 10.0.0.0/24 to any port =
https flags S/FSRA keep state label "443"
I have been following the following doc:
[http://www.inebriated.demon.nl/pf-howto], and there are examples in
there that filter for only SYN flags in a SYN+ACK mask. Which is
bizarre bec if I do that it doesn't work.
I'd be very happy if anyone could un-confuse me ;)
Thanks
- aW
