Avoid keeping state of ntp requests

Denny Lin dennylin93 at cnmc32.hs.ntnu.edu.tw
Mon Nov 16 11:03:09 UTC 2009


> I'm trying to avoid keeping state of ntp requests to our ntp servers.  They are on UDP and numerous, so it's just wasting a lot of space in the state table.
> 
> I've tried various variations of 'pass quick', but some rule keeps adding state for the port 123 requests.   I've put the full output of 'pfctl -sa' here:

Have you tried adding "no state" at the end of the rule? This way they
aren't added to the state table.

-- 
Denny Lin


More information about the freebsd-pf mailing list