pf BUG?

[Volker]

On 12/23/-58 20:59, KES wrote:
> Hello
> 
> I start to use ADSL
> My net work has next sturcture:
> CPU -iIP----  rl0 -SERVER -tun0---  >>>>> INET
> 
> I have next pf rules
> 
> 1) drop all
> 2) pass in quick on tun0 all
> 3) pass out quick on tun0 all
> 4) pass in on rl0 from $iIp to any
> 5) pass out on rl0 from any to $iIp
> 
> Next thing is wrong:
> If I ping inet from CPU
> 
> 2) pass in log-all on tun0 all
> 3) pass out quick on tun0 all
> 
> tpcdump pflog0 shows nothing
> But
> 2) pass in on tun0 all
> 3) pass out log-all quick on tun0 all
> 
> tpcdump pflog0 shows in and out traffic on tun0 interface!!!
> 
> System was builded from 2007-03-27 sources
> architecture is sparc64

This is not a pf bug.

I'm wondering why you're using a firewall at all? Your firewall is
nothing but just wide open (tm) and effectively useless.

Anyway, I really don't understand your problem. Do you really want
to have a firewall which does nothing but logging like crazy? BTW,
the log-all option does not make sense when not being used in
conjunction with stateful inspection.

HTH,

Volker