5

If pf is a stateful firewall and keeps state by default, why do so many rulesets explicitly mention keep state?

2 Answers 2

2

Without examples or asking the people who create the configurations, at least two reasons might be copying known working configurations without understanding the configurations or a partial configuration from a tutorial example where keep state is required while other configurations are unknown, such as set state-defaults.

2

To complement Paul's answer - I looked this up from the OpenBSD pf documentation:

The keep state option is the implicit default for all filter rules. Despite this, when specifying stateful options, one of the state keywords must still be used in front of the options.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .