Re: pf changes the order of filtering rules

2009-11-03 Thread Stuart Henderson
On 2009-11-03, Alexander Shikoff wrote: > Because I need queuing for outgoing traffic on vlan* interfaces. > When keep state is used then queues for outgoing traffic do not work. this (and variations) keep coming up (and has been answered 3 or 4 times in various mailing lists), but it's incorrect

Re: pf changes the order of filtering rules

2009-11-03 Thread Alexander Shikoff
On Wed, Nov 04, 2009 at 01:43:08AM +0200, Alexander Shikoff wrote: > On Tue, Nov 03, 2009 at 10:44:08PM +, Stuart Henderson wrote: > > On 2009-11-03, Alexander Shikoff wrote: > > > Because I need queuing for outgoing traffic on vlan* interfaces. > > > When keep state is used then queues for ou

Re: pf changes the order of filtering rules

2009-11-03 Thread Alexander Shikoff
On Tue, Nov 03, 2009 at 10:44:08PM +, Stuart Henderson wrote: > On 2009-11-03, Alexander Shikoff wrote: > > Because I need queuing for outgoing traffic on vlan* interfaces. > > When keep state is used then queues for outgoing traffic do not work. > > this (and variations) keep coming up (and

Re: pf changes the order of filtering rules

2009-11-03 Thread Cor
Henning Brauer wrote: how about reading the manpages for a change. sometimes i wonder why we write them. Please, PLEASE don't stop :) Seriously, this is one area where OpenBSD (and probably other BSDs, too) romp on Linux. I was debugging my pf syntax last weekend and took the time to

Re: pf changes the order of filtering rules

2009-11-03 Thread Alexander Shikoff
On Tue, Nov 03, 2009 at 05:00:39PM +0300, Vadim Zhukov wrote: > > Does anyone know how to disable this? Thanks in advance! > > 1. Why do you want to disable this? Did you even noticed actual problems? > > 2. See pf.conf(5), particularly part about "ruleset-optimization" option. > But better you

Re: pf changes the order of filtering rules

2009-11-03 Thread Vadim Zhukov
On 3 November 2009 G. 16:32:29 Alexander Shikoff wrote: > Hello! > > I have strange behavior of pf on my 4.6 box. > > Filtering rules are present in pf.conf in next order: > block in all > pass in quick on $ext_if proto tcp from any to ($ext_if) port ssh > pass out quick on $ext_if > pass in quick

Re: pf changes the order of filtering rules

2009-11-03 Thread Alexander Shikoff
On Tue, Nov 03, 2009 at 02:49:36PM +0100, Paul de Weerd wrote: > On Tue, Nov 03, 2009 at 03:32:29PM +0200, Alexander Shikoff wrote: > | Hello! > | > | I have strange behavior of pf on my 4.6 box. > | > | Filtering rules are present in pf.conf in next order: > | block in all > | pass in quick on $

Re: pf changes the order of filtering rules

2009-11-03 Thread Henning Brauer
* Alexander Shikoff [2009-11-03 14:40]: > I have strange behavior of pf on my 4.6 box. no. > Filtering rules are present in pf.conf in next order: > But after they loaded pfctl -sr shows another order: how about reading the manpages for a change. sometimes i wonder why we write them. oh sorry

Re: pf changes the order of filtering rules

2009-11-03 Thread Paul de Weerd
On Tue, Nov 03, 2009 at 03:32:29PM +0200, Alexander Shikoff wrote: | Hello! | | I have strange behavior of pf on my 4.6 box. | | Filtering rules are present in pf.conf in next order: | block in all | pass in quick on $ext_if proto tcp from any to ($ext_if) port ssh | pass out quick on $ext_if | p

pf changes the order of filtering rules

2009-11-03 Thread Alexander Shikoff
Hello! I have strange behavior of pf on my 4.6 box. Filtering rules are present in pf.conf in next order: block in all pass in quick on $ext_if proto tcp from any to ($ext_if) port ssh pass out quick on $ext_if pass in quick on $ext_if no state pass in quick on vlan609 from vlan609:network to a