floating keep state

[Vadym Chepkov]

All,

I must be doing something wrong, but I can't figure it out.
I actually simplify the network structure, to keep it simple

- a client and a web server are on different network segments;
- all incoming connections to the client are prohibited;
- client should be allowed to access web server and get a reply;

Here are the rules:

set state-policy floating
pass in quick proto tcp to <www_servers> port $www_tcp_ports flags
S/SA keep state
block in log to <protected_dev_net>

In the pflog I can see that reply packet from www server is blocked on
server's segment interface. I thought 'set state-policy floating'
should create a rule interface independent and allow a reply? Am I
wrong?

Thank you,
Vadym Chepkov