FreeBSD PF 4.1 Inserts Flags S/SA Automatically to rules

[Kian Mohageri]

On Wed, May 14, 2008 at 3:45 PM, Mark Pagulayan
<m.pagulayan at auckland.ac.nz> wrote:
> Hi Guys,
>
>
>
> OS: FreeBSD 7.0-RELEASE
>
>
>
> Please correct me if I am wrong that PF 4.1 in FreeBSD 7.0 automatically
> inserts 'Flags S/SA' to rules?
>
>

It does... actually 'flags S/SA keep state'.

>
> The problem is that when it comes to this rule:
>
>
>
> pass in quick on $int_if
>
>
>
> after loading to pf
>
>
>
> pass in quick on em0 flags S/SA keep state
>
>
>
> The way I see this is that this rule would be applied to udp traffic as
> well which will be dropped/blocked because flags only work for tcp and
> this might be the cause of state-mismatches that I see in the table -
>

'flags S/SA keep state' will work OK for UDP too.  Only the 'keep
state' part will be applied to UDP, since no flags are involved.

> state-mismatch                  11577272           48.7/s
>

Could be caused by reloading your ruleset to include 'keep state'
mid-connections, I think.  PF won't be aware of where the state is
(especially true if you're using TCP window scaling), so it will fail
after a while and you'll see state mismatches.

>
>
>
>
>  How can we prevent pf from loading the flags S/SA in the rules
> automatically?
>

Use 'no state' after the rule if it's necessary.  But keep in mind
stateful tracking is faster.  E.g.:

pass in on $ext_if no state

>
>
> Also what is the effect of this on the block rule?
>
>
>
> 'block in log on $ext_if all'
>
> 'block return out log on $ext_if all'
>
>

Not sure what you mean, but read pf.conf(5) man page.


-Kian