On 4/17/05, alex wilkinson <[EMAIL PROTECTED]> wrote:
> Hi all,
Hi,
> Question: Is it a necessity to allow the TCP ACK flag for www traffic
> {80,443} ?
>
> In my packet filtering rules I have explicitly masked the following flags:
>
> FSRA
>
> And am filtering for only SYN flags. i.e. S/FSRA.
>
> However, I am seeing the following in my logs:
>
> rule 5/0(match): pass in on wi0: 10.0.0.30.36280 > 194.159.245.16.80:
> S 1477848336:1477848336(0) win 16384 <mss 1460,nop,nop,sackOK,[|tcp]>
> (DF)
> rule 1/0(match): block in on tun0: 194.159.245.16.80 >
> 10.0.0.30.36280: S 57021312:57021312(0) ack 1477848337 win 5840 <mss
> 1420,nop,nop,sackOK>
>
> These are the rules I have for www traffic:
>
> pass in log quick on wi0 inet proto tcp from 10.0.0.0/24 to any port =
> www flags S/FSRA keep state label "80"
> pass in log quick on wi0 inet proto tcp from 10.0.0.0/24 to any port =
> https flags S/FSRA keep state label "443"
>
> I have been following the following doc:
> [http://www.inebriated.demon.nl/pf-howto], and there are examples in
> there that filter for only SYN flags in a SYN+ACK mask. Which is
> bizarre bec if I do that it doesn't work.
The examples have S/SA as does the PF faq (http://www.openbsd.org/faq/pf/) =]
Try it out... those are the flags I (and probably many many others
judging by the amount of faq's and example rulesets (and I've looked
at many many a ruleset online before getting into pf)) use and it
works 100%
> I'd be very happy if anyone could un-confuse me ;)
I'll leave the explanation to one of the others =]
> Thanks
>
> - aW
Stephen
