Re: pf blocks ACK response

[Darren Reed <avalon@coombs.anu.edu.au>]

In some mail from Luiz Gustavo, sie said:
> 
> On Thu, Mar 21, 2002 at 09:47:27AM +1100, Darren Reed wrote:
> 
> > > > block return-rst in quick proto tcp from 148.223.71.252/32 to any
> > > 
> > > I tired this, doesn't work, but don't understand what is behind it. What
> > > is the point in blocking something that is already not allowed through pf?
> > 
> > The point of that rule is the "return-rst".  It would need to be towards
> > the top of your rules, before any others which might cause it not to be
> > matched.  At least so adding it made it work with ipf.
> 
>  Why not...
> 
>  block return-rst in proto tcp from 148.223.71.252/32 to any flags S

Because the other end is sending a plain ACK packet (not SYN) and that
rule won't match those packets ?

Darren