Re: pf Roadmap

2002-08-10 Thread Daniel Hartmeier
On Sat, Aug 10, 2002 at 12:51:17PM +0200, Loic Cuguen wrote: > Is there any pf roadmap that we could discuss in term of features, > implementation and design ? There's no official roadmap, at least not one I'm aware of. The initial development was driven by missing features that developers thems

Re: Newbie Question (one of many to come)

2002-08-10 Thread Daniel Hartmeier
On Sat, Aug 10, 2002 at 09:37:15AM -0700, Chris Willis wrote: > I would like to create a filter that allows 4900&4901 inbound to the > machine that already has tcp 5000 open. If tcp 5000 isn't open, then I > do not want the UDP ports to be open inbound. Short answer: you can't. I know this i

Newbie Question (one of many to come)

2002-08-10 Thread Chris Willis
How can I setup a packet filter that works with a trigger? Example: I have an app that uses TCP 5000 for its connection state info, and UDP 4900 & 4901 for the actual work. I would like to create a filter that allows 4900&4901 inbound to the machine that already has tcp 5000 open. If tcp 500

pf Roadmap

2002-08-10 Thread Loic Cuguen
Is there any pf roadmap that we could discuss in term of features, implementation and design ? I'd like to help on the design side (if i can be of any help) and to me a good start could be a roadmap discussion. or perhaps I've missed something on the web and someone on this list could point me o

Re: Proper Syntax for Limiting Ports per user group.

2002-08-10 Thread Loic Cuguen
you don't, the per group and user rules tag is only available on -current. so wait and see. "Amir Seyavash Mesry" <[EMAIL PROTECTED]> writes: > Can some one tell me what the proper syntax is for using the user & > group parameters in OpenBSD 3.1 & PF. > here is and example rule. > pass out prot

Re: Pass In for out Syntax

2002-08-10 Thread Chris
Keep State does this for individual connections ... opening for everybody while you are connected to anyone has what advantage if you aren't wanting to open for everybody wanting your service regardless whether you're connected to anyone at the moment? IE, why not do a keep-state rule on outgo