Re: pf, nat and implicit state

[Daniel Hartmeier <daniel@benzedrine.cx>]

On Fri, Mar 15, 2002 at 02:08:57PM -0600, Luis Cerdas wrote:

> TCP  a.b.c.d:110 -> 192.168.20.39:49742       FIN_WAIT_2:FIN_WAIT_2
> TCP  192.168.20.39:49742 -> x.x.x.x:54642 -> a.b.c.d:110
> FIN_WAIT_2:FIN_WAIT_2
> 
> where a.b.c.d is a public, routable address and x.x.x.x is the IP we
> masquerade as (using NAT).
> 
> The rules do block everything coming in on the external if, and explicitly
> keep state on all allowed outgoing packets.
> 
> Is it necessary to add the 'keep state' option on outgoing packets, or does
> adding keep state to rules in pf.conf make the box keep double entries for
> the same connections, as those shown above??

It seems you're unintentionally creating state on the internal interface
as well, and the direction (->) indicates that it wasn't the inital SYN
packet that created state, but a reply from the external host.

Check your 'keep state' rules. Does one apply to the internal interface?
With 'flags S/SA' you can restrict rules to match only the initial SYN
packet.

Using 'keep state' on the rule that passes NATed connections is fine,
that's not the reason you get two state entries.

There's nothing wrong with creating two states, either, if you're doing
it intentionally (when you want to filter on both interfaces).

Daniel