UDP weirdness

[Jon Radel]

Jille wrote:
> 
> 
> 
> Ansar Mohammed schreef:
>> Ok, so adding the line as you suggested worked. Thanks Kevin.
>>
>> But why do I need to have both entries in for
>> pass in proto udp from any to any port 53
>> pass out proto udp from any to any port 53
>>
>> what makes UDP so special?
> UDP is stateless,
> With TCP you've got an connection (identified by: local host:port and
> remote host:port)
> With UDP, well, you just trow the packages over the line, and hope the
> is (still) someone on the other end.
> 
> So the is (almost) no way to detect whether packets are responses to
> eachother

Other than looking at local host:port and remote host:port and matching
things up....  Which PF does just fine ordinarily.  (Only exception I
can think of right now is if you're using a TFTP server which actually
implements the RFC rather than breaking it to make firewalls work....)
Current versions also match ICMP up with other traffic with which it is
associated.  But this has already been addressed in another reply.

I have reread this thread and can't find any indication of which version
of PF is running.  This makes it rather hard to comment on whether a
"keep state" would make things better, though I suspect you're using
FreeBSD 7.x.  So what follows are some thoughts which may or may not
apply to your implementation.  (Somebody else has already pointed out
when the default for keep state changed.)

pass in proto udp from any to any port 53
pass out proto udp from any to any port 53

can be combined into

pass proto udp from any to any port 53



If the rule set is complete as presented:

> > ext_if="le0"
> > int_if="le1"
> > int_net="192.168.3.0/24"
> > ext_net="192.168.2.0/24"
> > int_addr="192.168.3.1"
> > ext_addr="192.168.2.2"
> > scrub on $ext_if all reassemble tcp
> > scrub on $int_if all reassemble tcp
> > block in log all
> > pass in  proto icmp from any to any
> > pass in proto udp from any to any port 53
> > pass in on $ext_if inet proto tcp from any to any port 3389

then you're making use of the default action of "pass" on all outbound
traffic.  I wouldn't recommend doing that, particularly on a firewall.
To be specific, my firewall rulesets tend to start with

block log all

If you do that, then you need to do something such as

pass in on $int_if proto udp from any to any port 53 [keep state]
pass out on $ext_if proto udp all [keep state]

if you want machines on the inside to initiate DNS queries, which are
allowed to pass in on the internal interface and then out on the
external interface.

If you want DNS queries to be allowed in both directions (you have an
authoritative DNS server on the inside, or something...) you'd want
something like

pass in proto udp from any to any port 53 [keep state]
pass out proto udp all [keep state]

and that would cover both directions.

In writing this I am struck by an interesting question:  Is there a
possibility that what you're running into is a difference in the default
keep state behavior in the default pass rule between UDP and TCP.  The
documentation I've looked at has been silent on whether the default pass
rule is expected to establish state (for versions of PF recent enough),
and I'm not quite curious enough to build a testbed right now.  If
anyone knows the answer to this one, please do share.  :-)

--Jon Radel
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3283 bytes
Desc: S/MIME Cryptographic Signature
Url : http://lists.freebsd.org/pipermail/freebsd-pf/attachments/20080508/a7a435f4/smime.bin