Jille wrote: > > > > Ansar Mohammed schreef: >> Ok, so adding the line as you suggested worked. Thanks Kevin. >> >> But why do I need to have both entries in for >> pass in proto udp from any to any port 53 >> pass out proto udp from any to any port 53 >> >> what makes UDP so special? > UDP is stateless, > With TCP you've got an connection (identified by: local host:port and > remote host:port) > With UDP, well, you just trow the packages over the line, and hope the > is (still) someone on the other end. > > So the is (almost) no way to detect whether packets are responses to > eachother
Other than looking at local host:port and remote host:port and matching things up.... Which PF does just fine ordinarily. (Only exception I can think of right now is if you're using a TFTP server which actually implements the RFC rather than breaking it to make firewalls work....) Current versions also match ICMP up with other traffic with which it is associated. But this has already been addressed in another reply. I have reread this thread and can't find any indication of which version of PF is running. This makes it rather hard to comment on whether a "keep state" would make things better, though I suspect you're using FreeBSD 7.x. So what follows are some thoughts which may or may not apply to your implementation. (Somebody else has already pointed out when the default for keep state changed.) pass in proto udp from any to any port 53 pass out proto udp from any to any port 53 can be combined into pass proto udp from any to any port 53 If the rule set is complete as presented: > > ext_if="le0" > > int_if="le1" > > int_net="192.168.3.0/24" > > ext_net="192.168.2.0/24" > > int_addr="192.168.3.1" > > ext_addr="192.168.2.2" > > scrub on $ext_if all reassemble tcp > > scrub on $int_if all reassemble tcp > > block in log all > > pass in proto icmp from any to any > > pass in proto udp from any to any port 53 > > pass in on $ext_if inet proto tcp from any to any port 3389 then you're making use of the default action of "pass" on all outbound traffic. I wouldn't recommend doing that, particularly on a firewall. To be specific, my firewall rulesets tend to start with block log all If you do that, then you need to do something such as pass in on $int_if proto udp from any to any port 53 [keep state] pass out on $ext_if proto udp all [keep state] if you want machines on the inside to initiate DNS queries, which are allowed to pass in on the internal interface and then out on the external interface. If you want DNS queries to be allowed in both directions (you have an authoritative DNS server on the inside, or something...) you'd want something like pass in proto udp from any to any port 53 [keep state] pass out proto udp all [keep state] and that would cover both directions. In writing this I am struck by an interesting question: Is there a possibility that what you're running into is a difference in the default keep state behavior in the default pass rule between UDP and TCP. The documentation I've looked at has been silent on whether the default pass rule is expected to establish state (for versions of PF recent enough), and I'm not quite curious enough to build a testbed right now. If anyone knows the answer to this one, please do share. :-) --Jon Radel
smime.p7s
Description: S/MIME Cryptographic Signature
