[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: pf blocks ACK response
In some mail from Luiz Gustavo, sie said:
> On Thu, Mar 21, 2002 at 09:47:27AM +1100, Darren Reed wrote:
> > > > block return-rst in quick proto tcp from 126.96.36.199/32 to any
> > >
> > > I tired this, doesn't work, but don't understand what is behind it. What
> > > is the point in blocking something that is already not allowed through pf?
> > The point of that rule is the "return-rst". It would need to be towards
> > the top of your rules, before any others which might cause it not to be
> > matched. At least so adding it made it work with ipf.
> Why not...
> block return-rst in proto tcp from 188.8.131.52/32 to any flags S
Because the other end is sending a plain ACK packet (not SYN) and that
rule won't match those packets ?