Re: pf firewall rules, dns lookup not working

[Jason Hammerschmidt <Jason.Hammerschmidt@maclaren.com>]

> You can probably tweak the udp state timeout parameters. I suspect
> your nameserver is a bit slow. That, or it is doing something strange
> (not replying from port 53, perhaps?)
Well I know it's replying on port 53 because it works if I use these 
lines:
#Allow our machines to lookup stuff
pass in quick on $int_if proto udp from $network_ips to $dns_servers 
port 53
pass in quick on $int_if proto tcp from $network_ips to $dns_servers 
port 53
pass in quick on $ext_if proto udp from $dns_servers port 53 to 
$network_ips
pass in quick on $ext_if proto tcp from $dns_servers port 53 to 
$network_ips


How do I tweak udp state timeouts?  They should be set to something 
high by default, surely not in the <10 seconds range.  Any DNS request 
taking that long would be suicide.

> Why not add:
>
> antispoof = "{ 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8,
> 127.0.0.0/8, 0.0.0.0/8, 224.0.0.0/3, 204.152.64.0/23,  169.254.0.0/16
> }"
>
> and simplify your rules a bit? ie
>
>  block in log quick from $antispoof to any
cause that would just be the better way! c'mon now.