Re: pf 'synproxy state' doesn't work with pppoe

2012-08-19 Thread LEVAI Daniel
On cs, aug 16, 2012 at 20:43:18 +0100, Kevin Chadwick wrote: pass all flags S/SA pass in on pppoe0 inet proto tcp from src to dst port = flags S/SA synproxy state Originally you posted pass in quick. Keep the quick in there, not for any reason other than I have a quick

pf 'synproxy state' doesn't work with pppoe

2012-08-16 Thread LEVAI Daniel
Hi! I'm using 5.1-stable on two machines with pppoe connections. The pf synproxy state option doesn't work on pppoe interfaces, it just sends back a TCP reset when trying to connect to a port configured with synproxy state. Meanwhile it works on any other interface (eg. the internal LAN

Re: pf 'synproxy state' doesn't work with pppoe

2012-08-16 Thread LEVAI Daniel
On cs, aug 16, 2012 at 12:19:06 +0200, LEVAI Daniel wrote: [...] Forgot the dmesg. If it matters. OpenBSD 5.1-stable (GENERIC) #0: Tue Aug 7 02:00:34 CEST 2012 root@.:/usr/src/sys/arch/i386/compile/GENERIC cpu0: Intel(R) Pentium(R) 4 CPU 2.40GHz (GenuineIntel 686-class) 2.42 GHz cpu0:

Re: pf 'synproxy state' doesn't work with pppoe

2012-08-16 Thread Kevin Chadwick
Any help would be appreciated. Works for me on 5.1 I don't think it's the rule but the combination of rules. Try reordering your ruleset. I've had a problem before but I forget or never found the specific reason. -- ___

Re: pf 'synproxy state' doesn't work with pppoe

2012-08-16 Thread LEVAI Daniel
On cs, aug 16, 2012 at 12:20:56 +0100, Kevin Chadwick wrote: Any help would be appreciated. Works for me on 5.1 I don't think it's the rule but the combination of rules. Try reordering your ruleset. I've had a problem before but I forget or never found the specific reason. Okay, okay,

Re: pf 'synproxy state' doesn't work with pppoe

2012-08-16 Thread LEVAI Daniel
On cs, aug 16, 2012 at 14:26:05 +0200, LEVAI Daniel wrote: On cs, aug 16, 2012 at 12:20:56 +0100, Kevin Chadwick wrote: Any help would be appreciated. Works for me on 5.1 I don't think it's the rule but the combination of rules. Try reordering your ruleset. I've had a problem

Re: pf 'synproxy state' doesn't work with pppoe

2012-08-16 Thread Kevin Chadwick
# pfctl -sr pass all flags S/SA pass in on pppoe0 inet proto tcp from src to dst port = flags S/SA synproxy state This is the only rule. Otherwise it's just 'pass all'. If I remove this rule too *or* change synproxy to keep, the connection is working. I remember being puzzled by

Re: pf 'synproxy state' doesn't work with pppoe

2012-08-16 Thread Christopher Zimmermann
On Thu, 16 Aug 2012 14:37:50 +0200 LEVAI Daniel l...@ecentrum.hu wrote: On cs, aug 16, 2012 at 14:26:05 +0200, LEVAI Daniel wrote: On cs, aug 16, 2012 at 12:20:56 +0100, Kevin Chadwick wrote: Any help would be appreciated. Works for me on 5.1 I don't think it's the rule but

Re: pf 'synproxy state' doesn't work with pppoe

2012-08-16 Thread LEVAI Daniel
On cs, aug 16, 2012 at 17:18:08 +0200, Christopher Zimmermann wrote: On Thu, 16 Aug 2012 14:37:50 +0200 LEVAI Daniel l...@ecentrum.hu wrote: On cs, aug 16, 2012 at 14:26:05 +0200, LEVAI Daniel wrote: On cs, aug 16, 2012 at 12:20:56 +0100, Kevin Chadwick wrote: Any help would be

Re: pf 'synproxy state' doesn't work with pppoe

2012-08-16 Thread LEVAI Daniel
On cs, aug 16, 2012 at 15:10:51 +0100, Kevin Chadwick wrote: # pfctl -sr pass all flags S/SA pass in on pppoe0 inet proto tcp from src to dst port = flags S/SA synproxy state This is the only rule. Otherwise it's just 'pass all'. If I remove this rule too *or* change synproxy

Re: pf 'synproxy state' doesn't work with pppoe

2012-08-16 Thread Kevin Chadwick
pass all flags S/SA pass in on pppoe0 inet proto tcp from src to dst port = flags S/SA synproxy state Originally you posted pass in quick. Keep the quick in there, not for any reason other than I have a quick in my rules. Same with the NIC, I don't have any logical hopes for