Re: ICMP Ruleset Behavior

--001a1144b702644abb0538ff9ae7
Content-Type: text/plain; charset=UTF-8

Dear Peter,

indeed last match wins, but both the other rules have the quick keyword.
So if there was a match, it should happen.
So in this case, why does this order match ?

Panagiotis Galiotos

On Sat, Jul 30, 2016 at 2:30 PM, Peter N. M. Hansteen <[email protected]>
wrote:

>
>
> On 07/30/16 06:08, Aaron Hofer wrote:
> > Trying to replicate some functionality with PF that I had with a cisco
> > asa.  I'm trying to explicitly allow echo requests outbound and only
> > echo replies inbound but it's not working.  Here's my current rules for
> > this, but I can't ping anything beyond the external interface though.
> >
> > pass out quick on egress inet proto icmp icmp-type echoreq no state
> > pass in quick on egress inet proto icmp icmp-type echorep no state
> > block quick on egress inet proto icmp all
>
> Last match wins, so if you move the block up before the pass rules, you
> should see a difference.
>
>
> --
> Peter N. M. Hansteen, member of the first RFC 1149 implementation team
> http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/
> "Remember to set the evil bit on all malicious network traffic"
> delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.
>

--001a1144b702644abb0538ff9ae7
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Dear Peter,<div><br></div><div>indeed last match wins, but=
 both the other rules have the quick keyword.</div><div>So if there was a m=
atch, it should happen.</div><div>So in this case, why does this order matc=
h ?</div><div><br></div><div>Panagiotis Galiotos</div></div><div class=3D"g=
mail_extra"><br><div class=3D"gmail_quote">On Sat, Jul 30, 2016 at 2:30 PM,=
 Peter N. M. Hansteen <span dir=3D"ltr">&lt;<a href=3D"mailto:[email protected]=
et" target=3D"_blank">[email protected]</a>&gt;</span> wrote:<br><blockquote =
class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid=
;padding-left:1ex"><br>
<br>
On 07/30/16 06:08, Aaron Hofer wrote:<br>
&gt; Trying to replicate some functionality with PF that I had with a cisco=
<br>
&gt; asa.=C2=A0 I&#39;m trying to explicitly allow echo requests outbound a=
nd only<br>
&gt; echo replies inbound but it&#39;s not working.=C2=A0 Here&#39;s my cur=
rent rules for<br>
&gt; this, but I can&#39;t ping anything beyond the external interface thou=
gh.<br>
&gt;<br>
&gt; pass out quick on egress inet proto icmp icmp-type echoreq no state<br=
>
&gt; pass in quick on egress inet proto icmp icmp-type echorep no state<br>
&gt; block quick on egress inet proto icmp all<br>
<br>
Last match wins, so if you move the block up before the pass rules, you<br>
should see a difference.<br>
<span class=3D"HOEnZb"><font color=3D"#888888"><br>
<br>
--<br>
Peter N. M. Hansteen, member of the first RFC 1149 implementation team<br>
<a href=3D"http://bsdly.blogspot.com/">http://bsdly.blogspot.com/</a> <a hr=
ef=3D"http://www.bsdly.net/">http://www.bsdly.net/</a> <a href=3D"http://ww=
w.nuug.no/">http://www.nuug.no/</a><br>
&quot;Remember to set the evil bit on all malicious network traffic&quot;<b=
r>
delilah spamd[29949]: <a href=3D"http://85.152.224.147">85.152.224.147</a>:=
 disconnected after 42673 seconds.<br>
</font></span></blockquote></div><br></div>

--001a1144b702644abb0538ff9ae7--