Security warning with sshd

Alexander Leidinger Alexander at
Wed Aug 24 08:30:10 GMT 2005

Pat Maddox <pergesu at> wrote:

> Hey guys, thanks for the help so far.  I'm going to post this to the
> freebsd-pf list to see if anyone has any ideas...but I'm using PF, and
> here's the config.  Hopefully you can take a look and see what the
> problem may be.  As I said earlier, I'm not positive why I'm getting
> those errors, but I believe it's because my SSH connection is getting
> cut off whenever I enable the firewall.  I've also been looking for a
> way to not be cut off (since it's very annoying), and it seems like
> figuring out and correcting these errors will also fix the second
> problem.

You have to enable the firewall before you use ssh.

A stateful firewall can't know about connections which get setup before the
firewall is started. Since the firewall starts with a clean state, it has to
assume that no connection is valid and blocks every already established

So the behavior you see is what you requested from the system by starting the
firewall after starting a ssh session. There's no need to be scared, it's not
a security flaw, but you have to change your expectations.


--  Alexander @ PGP ID = B0063FE7     netchild @  : PGP ID = 72077137
Don't you feel more like you do now than you did when you came in?

More information about the freebsd-questions mailing list