Help with IP Filter 4.1.8

[Roman Serbski]

On 2/27/06, Erik Norgaard <norgaard at locolomo.org> wrote:
> read this line: This tells you where the packet is blocked. IIRC @0:2
> means group 0 (you don't use groups) and 2 should be the second rule.
>
> If you list the ruleset with ipfstat -n that should give you rules with
> the same labeling.
>
> Also, add log keyword to your outgoing rule, to see that it is actually
> there the decision is made. You could have some default pass that does
> not create the state.
>
> I know that you've checked and rechecked - but it is really helpful for
> us to have the whole ruleset. If you like, change your ip's to x.x.x.x
> (but keep different ips different).

Hello Erik,

My ruleset consists of only 6 rules:

pass out quick on lo0 from any to any
pass out quick on xl0 proto tcp from any to any port = domain flags
S/FSRPAU keep state
pass out quick on xl0 proto udp from any to any port = domain keep state
block out log quick on xl0 all
pass in quick on lo0 from any to any
block in quick on xl0 all

The rule # 2 which was blocking reply from DNS server is 'block in
quick on xl0 all'.

Adding 'log' keyword to the rule allowing outgoing 53/udp gives the following:

xl0 @0:3 p YYY.YYY.YYY.YYY,50359 -> XXX.XXX.XXX.XXX,53 PR udp len 20 57 K-S OUT

So outgoing 53/udp was successfully passed through, but incoming reply
was blocked again:

xl0 @0:2 b XXX.XXX.XXX.XXX,53 -> YYY.YYY.YYY.YYY,50359 PR udp len 20 298 IN bad

Yes, I also tried another DNS server - same results.

I think this is more ipf issue, so I'll try to ask for assistance in
ipf maling list, I was just thinking if someone else has faced with
the similar problem during upgrade from ipf v3.4.35 to v4.1.8.

Thank you.