If pf
is a stateful firewall and keeps state by default, why do so many rulesets explicitly mention keep state
?
2 Answers
Without examples or asking the people who create the configurations, at least two reasons might be copying known working configurations without understanding the configurations or a partial configuration from a tutorial example where keep state
is required while other configurations are unknown, such as set state-defaults
.
To complement Paul's answer - I looked this up from the OpenBSD pf documentation:
The keep state option is the implicit default for all filter rules. Despite this, when specifying stateful options, one of the state keywords must still be used in front of the options.