So I am using FreeBSD 7 and it doesn't work either way with "keep state" there or not. The only catch here is that everything is running on VMWare, although that should not matter. I have been using pf for about 2 years now. I feel this may be a bit of a bug.
I even set the state-policy to floating (which I believe is default) and still I need the second rule. > -----Original Message----- > From: Jeremy Chadwick [mailto:[EMAIL PROTECTED] > Sent: May 7, 2008 5:44 PM > To: Ansar Mohammed > Cc: 'Jille'; freebsd-pf@freebsd.org > Subject: Re: UDP weirdness > > On Wed, May 07, 2008 at 04:54:22PM -0400, Ansar Mohammed wrote: > > But I thought pf would be tracking state? > > Isnt that the whole point of statefull firewalls? > > UDP is stateless, however pf still tracks the "state" in the sense that > it knows when there's an outbound or inbound initial packet for UDP, > thus creates a "state" for it. It can do the same with ICMP. I > believe > the teardown/state removal is based on a timeout (of when it last sees > packets matching that src/dst IP and port). > > Keep in mind that if you're using RELENG_6, you'll need "keep state" on > those pass in/pass out rules you used. If you're using RELENG_7, "keep > state" is implicit, so you won't need to specify it in your config. > > -- > | Jeremy Chadwick jdc at parodius.com | > | Parodius Networking http://www.parodius.com/ | > | UNIX Systems Administrator Mountain View, CA, USA | > | Making life hard for others since 1977. PGP: 4BD6C0CB | _______________________________________________ freebsd-pf@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-pf To unsubscribe, send any mail to "[EMAIL PROTECTED]"
