0

Our PF firewall contains this:

. . .
scrub in all fragment reassemble no-df max-mss 1440
### em1 ipv4 = 123.12.3.234
nat               log   on $ext_if \
                  from  $net_nat \
                  to    any -> ($ext_if)
. . .
antispoof         log   for $ext_if
block return  out log   all
block drop    in  log   all
. . .

Followed somewhat later by this:

pass          in  log   quick \
                  from  11.22.33.164 \
                  to    any

pass          out log   quick \
                  from  any \
                  to    11.22.33.164

However, TCPDUMP shows this happening:

 00:00:00.116888 rule 3/0(match): block in on em1: 11.22.33.164.2148 > 123.12.3.234.59865: Flags [R.], seq 1, ack 1, win 5707, length 0

 00:00:00.115632 rule 3/0(match): block in on em1: 11.22.33.164.2148 > 123.12.3.234.62733: Flags [R.], seq 1, ack 1, win 159, length 0

 00:00:00.011031 rule 2/0(match): block out on em1: 123.12.3.234.64105 > 11.22.33.164.2148: Flags [P.], seq 2111901423:2111901475, ack 316150303, win 258, length 52

 00:00:00.074555 rule 3/0(match): block in on em1: 11.22.33.164.2148 > 123.12.3.234.58208: Flags [.], ack 1, win 159, length 0

 00:00:00.065409 rule 3/0(match): block in on em1: 11.22.33.164.2148 > 123.12.3.234.56489: Flags [.], ack 1, win 159, length 0

 00:00:00.077103 rule 3/0(match): block in on em1: 11.22.33.164.2148 > 123.12.3.234.62245: Flags [P.], seq 0:36, ack 1, win 136, length 36

 00:00:00.040241 rule 3/0(match): block in on em1: 11.22.33.164.2148 > 123.12.3.234.58208: Flags [.], ack 1, win 159, length 0

 00:00:00.026616 rule 3/0(match): block in on em1: 11.22.33.164.2148 > 123.12.3.234.56489: Flags [R.], seq 1, ack 1, win 159, length 0

My question is: Why? What is causing the later 'quick' rule to not match and instead letting the default rules take effect?

  • Run "pfctl -sr -vv", identify and post the the blocking rules. – Vladimir Botka Feb 23 at 6:59
  • Rule 2 is: block return out log all Rule 3 is: block drop in log all – James B. Byrne Feb 26 at 16:57

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.