pf synproxy in 6.0

[Alex]

В ср, 23/11/2005 в 14:55 +0100, Max Laier пишет:
> On Wednesday 23 November 2005 14:42, Alex wrote:
> > In contrast, looks like synproxy is _not_ working in 6-stable from
> > November, 22nd.
> > The same ruleset for inbound traffic is working successfully on
> > 5.4-STABLE.
> > The workaround I've done is a change 'synproxy' option to 'modulate'
> > Any ideas and info?
> 
> There has been a change in how synproxy works.  With OpenBSD's revision 1.437 
> of pf.c: http://www.openbsd.org/cgi-bin/cvsweb/src/sys/net/pf.c#rev1.437 the 
> secondary handshake no longer passes unconditionally, but must be allowed by 
> a separate rule.  Something like:
> 
> pass on $int_if proto tcp from any to $synproxied flags S/SA
> 
> should do.  Can you please check and confirm?  I am afraid this difference in 
> behavior from normal "keep/modulate" vs. "synproxy" is underdocumented - 
> suggestions appreciated.

Unfortunately I've got only 1 NIC on machine and requested service is
running on the same FreeBSD box.

Here's my ruleset :
ext_if="vr0"
pass in quick on $ext_if proto icmp from any to $ext_if icmp-type
echoreq
pass in quick on $ext_if proto icmp from any to $ext_if icmp-type
echorep
pass out quick on $ext_if proto icmp from $ext_if to any icmp-type
echoreq
pass out quick on $ext_if proto icmp from $ext_if to any icmp-type
echorep
block in quick on $ext_if proto icmp from any to any
block out quick on $ext_if proto icmp from any to any
pass quick on lo0 all
pass in log quick on $ext_if proto tcp from any to $ext_if port { ssh,
smtp, pop3 } flags S/SA synproxy state
pass out quick on $ext_if proto tcp all modulate state flags S/SA
pass out quick on $ext_if proto udp all keep state
block in log on $ext_if

What's to be added to take synproxy into working state?

-- 
Alex <alextols at gmail.com>