FreeBSD PF 4.1 Inserts Flags S/SA Automatically to rules

[Mark Pagulayan]

Hi Guys, 

 

OS: FreeBSD 7.0-RELEASE 

 

Please correct me if I am wrong that PF 4.1 in FreeBSD 7.0 automatically
inserts 'Flags S/SA' to rules? 

 

The problem is that when it comes to this rule: 

 

pass in quick on $int_if

 

after loading to pf

 

pass in quick on em0 flags S/SA keep state

 

The way I see this is that this rule would be applied to udp traffic as
well which will be dropped/blocked because flags only work for tcp and
this might be the cause of state-mismatches that I see in the table -  

state-mismatch                  11577272           48.7/s

 

 

 How can we prevent pf from loading the flags S/SA in the rules
automatically?

 

Also what is the effect of this on the block rule?

 

'block in log on $ext_if all'

'block return out log on $ext_if all'

 

 

Cheers, 

 

Mark