Re: PF failing to block?

[Daniel Hartmeier <daniel@benzedrine.cx>]

On Mon, Feb 18, 2002 at 05:08:44PM -0500, Blair Heiserman wrote:

> Feb 18 11:51:30.658275 rule 15/0(match): block in on fxp0: 
> 12.87.132.204.2438 > *.*.*.77.80: S 1246986737:1246986737(0) win 8760 <mss 
> 1460,nop,nop,sackOK> (DF)
> Feb 18 11:51:30.658947 rule 53/0(match): pass out on fxp0: *.*.*.77.80 > 
> 12.87.132.204.2438: R 0:0(0) ack 1246986738 win 0

Oh, is that TCP RST actually sent by .77?

Your 'block ... proto tcp ... flags S/SA' rule is a little odd. It does
only block TCP packets with SYN set and ACK unset. Other TCP packets can
get through, and the answers of the internal host that get out then
create state.

Usually, you'd use 'flags S/SA' on the pass rule that creates state, and
don't specify flags in general block rules. Try without specifying
flags, unless you know what you want there.

Daniel