Re: PF gateway problems.. return traffic blocked (but not if in N AT m ode!)

[Daniel Hartmeier <daniel@benzedrine.cx>]

On Fri, Jun 21, 2002 at 05:30:05PM +1000, Adrian Buxton wrote:

> They create states on both interfaces? Where?? The only rules relating to
> this are 
> 
> pass in quick on $int_if proto tcp from $int_nets to any flags S keep state
> pass in quick on $int_if proto { icmp, udp } from $int_nets to any keep state

But you also have

pass out quick on $ext_if proto tcp from $ext_if to any flags S keep state
pass out quick on $ext_if proto { icmp, udp } from $ext_if to any keep state

So a connection from a local machine to an external machine comes in on
$int_if, creates state there, then goes out through $ext_if (with source
address $ext_if, since you NAT) and creates states again. Two states.

> So, this means I have to keep state on the external interface else the
> return traffic is dropped?

If you have a default block on both interfaces, yes.

Daniel