Re: pf: 'block drop' used, but ICMP unreachables returned anyway...

2006-10-13 Thread Martin Gignac
On 10/13/06, Kian Mohageri <[EMAIL PROTECTED]> wrote: Check out the 3 articles on PF by Daniel Hartmeier (OpenBSD developer). I found them to be very clear and concise and I'm pretty sure his explanations will help you out. http://www.undeadly.org Thanks for the suggestion! One of these artic

Re: pf: 'block drop' used, but ICMP unreachables returned anyway...

2006-10-13 Thread Kian Mohageri
On 10/12/06, Martin Gignac <[EMAIL PROTECTED]> wrote: > > > Man, I need "The Utterly Dumbass' Guide to pf" (with pretty pictures) > 'cause my brain doesn't seem to be equipped to understand this concept > clearly. :-) > > Check out the 3 articles on PF by Daniel Hartmeier (OpenBSD developer). I f

Re: pf: 'block drop' used, but ICMP unreachables returned anyway...

2006-10-12 Thread Martin Gignac
On 10/13/06, Joe Gibbens <[EMAIL PROTECTED]> wrote: I'm guessing its because the default state policy is floating. Just looking at the rules provided, the traffic should be able to pass through. Funny you should mention that because this is what I initially thought (that at #2 traffic should p

Re: pf: 'block drop' used, but ICMP unreachables returned anyway...

2006-10-12 Thread Joe Gibbens
I'm guessing its because the default state policy is floating. Just looking at the rules provided, the traffic should be able to pass through. Try either pulling the "keep state" option, or setting the state policy to if-bound, and see what happens. So if it should be working now, why isn't it?

pf: 'block drop' used, but ICMP unreachables returned anyway...

2006-10-12 Thread Martin Gignac
Consider the following setup (OpenBSD 4.0-current): Win PC > (vlan1) [OpenSD FW] (vlan0) > Host 1. With the following pf ruleset: set skip on { lo0 } scrub all fragment reassemble block drop all A ping command on the Windows PC towards the Host (172.23.1.21) gives the following (expect