pf's states

Victor Sudakov vas at
Sun Dec 1 16:11:56 UTC 2019

Dear Colleagues,

I was asking this question on the freebsd-net mailing list, but I think
it would be better to re-ask it here.

There is something I cannot understand about pf's notion of state. 

Consider this very simple example with two interfaces:

pass in on $dmz
#block in on $dmz from any to

# Inside
pass in on $inside

While the "block ..." line is commented out, I can "telnet 80" from
But when I uncomment the "block ..." line and restart pf, I cannot do
that any more. Why is that?

My idea was that the "pass in on $inside" creates state so that return
traffic from to should be permitted,
but this is not happening so I must be wrong in my understaning how
state works.

Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
2:5005/49 at fidonet
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 455 bytes
Desc: not available
URL: <>

More information about the freebsd-net mailing list