UDP weirdness

[Ansar Mohammed]

So I am using FreeBSD 7 and it doesn't work either way with "keep state"
there or not. The only catch here is that everything is running on VMWare,
although that should not matter. I have been using pf for about 2 years now.
I feel this may be a bit of a bug. 

I even set the state-policy to floating (which I believe is default) and
still I need the second rule.





> -----Original Message-----
> From: Jeremy Chadwick [mailto:koitsu at freebsd.org]
> Sent: May 7, 2008 5:44 PM
> To: Ansar Mohammed
> Cc: 'Jille'; freebsd-pf at freebsd.org
> Subject: Re: UDP weirdness
> 
> On Wed, May 07, 2008 at 04:54:22PM -0400, Ansar Mohammed wrote:
> > But I thought pf would be tracking state?
> > Isnt that the whole point of statefull firewalls?
> 
> UDP is stateless, however pf still tracks the "state" in the sense that
> it knows when there's an outbound or inbound initial packet for UDP,
> thus creates a "state" for it.  It can do the same with ICMP.  I
> believe
> the teardown/state removal is based on a timeout (of when it last sees
> packets matching that src/dst IP and port).
> 
> Keep in mind that if you're using RELENG_6, you'll need "keep state" on
> those pass in/pass out rules you used.  If you're using RELENG_7, "keep
> state" is implicit, so you won't need to specify it in your config.
> 
> --
> | Jeremy Chadwick                                jdc at parodius.com |
> | Parodius Networking                       http://www.parodius.com/ |
> | UNIX Systems Administrator                  Mountain View, CA, USA |
> | Making life hard for others since 1977.              PGP: 4BD6C0CB |