floating keep state

[Daniel Hartmeier]

On Wed, Feb 27, 2008 at 11:02:08PM -0500, Vadym Chepkov wrote:

> My question is, why the reply packet was blocked?

It seems you're misunderstanding what 'floating state' means.

It does NOT mean "allow connection on all interfaces".

If a connection traverses two interfaces, you need to allow it on both,
creating two two separate state entries (one incoming, one outgoing).

The 'floating' would come into play if you had more than two interfaces,
and the same connection would traverse all three of them, due to dynamic
routing. Without dynamic routing, you can pretty much forget about
floating states, they do nothing.

The first problem in your ruleset is that it does not block by default.
Instead, the packet goes out through xl0 based on the implicit pass rule
and does not create a second state.

When the reply comes back in on xl0, there is no matching state (the
first one created on xl1 does NOT match, as direction is reversed), and
no pass rule matches on that interface in this direction. Hence the
block.

Add a default block, add a 'pass out ... keep state' rule, and it will
work.

You probably thought floating states would do that, but they don't.

Daniel