On Sun, Sep 14, 2003 at 01:22:37AM -0500, Peter H. Coffin wrote: > There's no connection, and no state to keep. Let them back in. pf.conf(5) says otherwise: ICMP error messages, which always refer to a TCP or UDP packet, are matched against the referred to connection. [...] For ICMP queries, keep state creates an ICMP state, and pf(4) knows how to match ICMP replies to states. -- mls