Re: strange results with pf

[Daniel Hartmeier <daniel@benzedrine.cx>]

On Wed, Aug 20, 2003 at 01:26:35PM +0400, Alexei G. Malinin wrote:

> The talk is about all protocols (not only tcp) and protocol scanning by
> nmap.

Make sure you are scanning from a separate host. Running nmap on the
firewall itself (against one of its own addresses or another host) will
cause EHOSTUNREACH errors from the stack when pf blocks outgoing
packets (like, when you allow only flags S/SA to create state and block
by default, but nmap tries to send ACK, SYN+ACK or xmas flags).

Daniel