PF blocking outbound packets that don't have S/SA flags

2008-11-21 Thread Joe S
OS: OpenBSD 4.4 RELEASE i386 PF is blocking traffic that I want it to pass. I notice this when I run nmap 4.76 (compiled from source). It appears that my packets are being dropped because they don't match the pass out quick rule in my pf.conf. I noticed this rule is modified due to the default

Re: PF blocking outbound packets that don't have S/SA flags

2008-11-21 Thread Girish Venkatachalam
On 01:10:03 Nov 21, Joe S wrote: OS: OpenBSD 4.4 RELEASE i386 PF is blocking traffic that I want it to pass. I notice this when I run nmap 4.76 (compiled from source). It appears that my packets are being dropped because they don't match the pass out quick rule in my pf.conf. I noticed this

Re: PF blocking outbound packets that don't have S/SA flags

2008-11-21 Thread Stuart Henderson
On 2008-11-21, Joe S [EMAIL PROTECTED] wrote: How do I create a rule to ignore the flags S/SA Read pf.conf(5) about flags.

Re: PF blocking outbound packets that don't have S/SA flags

2008-11-21 Thread Vinicius Vianna
Joe S escreveu: OS: OpenBSD 4.4 RELEASE i386 PF is blocking traffic that I want it to pass. I notice this when I run nmap 4.76 (compiled from source). It appears that my packets are being dropped because they don't match the pass out quick rule in my pf.conf. I noticed this rule is modified due

Re: PF blocking outbound packets that don't have S/SA flags

2008-11-21 Thread Joe S
On Fri, Nov 21, 2008 at 2:11 AM, Stuart Henderson [EMAIL PROTECTED] wrote: On 2008-11-21, Joe S [EMAIL PROTECTED] wrote: How do I create a rule to ignore the flags S/SA Read pf.conf(5) about flags. Thanks. I read everything but that man page. I added flags any to my pass out rule and my

Re: PF blocking outbound packets that don't have S/SA flags

2008-11-21 Thread Daniel Melameth
On Fri, Nov 21, 2008 at 10:46 AM, Joe S [EMAIL PROTECTED] wrote: I added flags any to my pass out rule and my packets are no longer blocked by rule 0. # pfctl -s rules block return log all block return in quick inet6 all pass quick proto icmp all keep state allow-opts pass out quick all

Re: PF blocking outbound packets that don't have S/SA flags

2008-11-21 Thread Joe S
On Fri, Nov 21, 2008 at 2:13 PM, Daniel Melameth [EMAIL PROTECTED] wrote: Perhaps you're hitting pf's default state limit? If you're going to be nmapping, I highly recommend doing it from a host that's not firewalled. Could be. I will look into that. I'm starting to wonder if the error

Re: PF blocking outbound packets that don't have S/SA flags

2008-11-21 Thread Joe S
On Fri, Nov 21, 2008 at 2:29 PM, Joe S [EMAIL PROTECTED] wrote: On Fri, Nov 21, 2008 at 2:13 PM, Daniel Melameth [EMAIL PROTECTED] wrote: Perhaps you're hitting pf's default state limit? If you're going to be nmapping, I highly recommend doing it from a host that's not firewalled. Could

Re: PF blocking outbound packets that don't have S/SA flags

2008-11-21 Thread Stuart Henderson
On 2008-11-21, Joe S [EMAIL PROTECTED] wrote: On Fri, Nov 21, 2008 at 2:13 PM, Daniel Melameth [EMAIL PROTECTED] wrote: Perhaps you're hitting pf's default state limit? If you're going to be nmapping, I highly recommend doing it from a host that's not firewalled. Could be. I will look into