Ok. I understand that, but in FreeBSD 4.11 it works and without the "keep frags" the query is blocked. Is it just a misbehaviour of an old ipf version?
And there is also the different behaviour of pf under OpenBSD. As I understand, the "scrub" rule should reassemble the fragments and pass the complete packet on to the filter, making the response arrive to the application. Am I wrong? On Fri, May 18, 2007 at 09:50:58AM +1000, Mark Andrews wrote: > > > > > This should be rejected as "keep frags" is meaningless here. > > > > pass out log quick on bge0 proto udp from xxx.xxx.xxx.113/32 to any port = > > 53 > > keep state keep frags > > > > You need > > > > pass in quick from any to any with frag keep frag > > The reason is that "ip" fragments not have next level headers. > _______________________________________________ freebsd-net@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "[EMAIL PROTECTED]"
