Understanding if-bound vs floating state policy

--bp/iNruPH9dso1Pn
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Dear Colleagues,

I'm trying to figure out the difference between floating and if-bound
states. Let's consider a simple ruleset with just 2 rules:

root@fw:~ # pfctl -vvs rules
No ALTQ support in kernel
ALTQ related functions disabled
@0 block return in on dmz all
  [ Evaluations: 2282      Packets: 1022      Bytes: 85848       States: 0 =
    ]
  [ Inserted: uid 0 pid 822 State Creations: 0     ]
@1 pass in on inside all flags S/SA keep state
  [ Evaluations: 1771      Packets: 511       Bytes: 42924       States: 1 =
    ]
  [ Inserted: uid 0 pid 822 State Creations: 1     ]
root@fw:~ #

Let's ping host 172.16.1.10 (attached to the "dmz" interface) from host
192.168.10.3 (attached to the "inside" interface) via the router.

Echo requests from 192.168.10.3 to 172.16.1.10 match Rule 1 and are
passed, and echo replies from 172.16.1.10 to 192.168.10.3 match Rule 0
and are blocked by the rule.

However, pinging 172.16.1.10 from 192.168.10.3 creates the following "all" =
state:

root@fw:~ # pfctl -vvs state
No ALTQ support in kernel
ALTQ related functions disabled
all icmp 172.16.1.10:31234 <- 192.168.10.3:31234       0:0
   age 00:12:08, expires in 00:00:10, 694:0 pkts, 58296:0 bytes, rule 1
   id: 000000005df37f65 creatorid: 66d731d7
root@fw:~ #

Why is this state not permitting the reversed packets (echo
replies) from 172.16.1.10 to 192.168.10.3 incoming via the "dmz" interface?

It is my understanding that with the default "state-policy=3Dfloating",
reversed packets should be passed from 172.16.1.10 to 192.168.10.3,
but it is not happening.

This behaviour would be expected with "state-policy=3Dif-bound", but
with "state-policy=3Dfloating" shouldn't the states be global?

What am I missing?=20


--=20
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
2:5005/49@fidonet http://vas.tomsk.ru/

--bp/iNruPH9dso1Pn
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEcBAEBAgAGBQJd8zx6AAoJEA2k8lmbXsY0Xq8IAKIYkfk6DrfJie/kl4/ZBq2C
gOZ1BPDIZUQjks7Ytap6OtCXqTXMhS0wGSVxwkpXArf4r1DMd2BRFVwbyC+UL9lj
oExVLQy7TIgL+YfaS3QpKWxqllFD8gtVDyJdY8hX8eUbVtslF3tnFtxUM4h1iMW2
2QDKx91SW25s2BGsI1S2uGhLF5bnacA53+WxbiHQM5tPLsQ97KxSJidJMizRPl1a
DGIA0d1xp7r9rudru93IROEZlB7PXkSVzBvum5kqxX6ieUB4nmFut+uv+bVpfGZZ
f47356N1ZSjjmd8AqylM/aIZAhN0iM65qy/mNEjmCYtFdVWP3UIwoaQmrvctGxw=
=GKUB
-----END PGP SIGNATURE-----

--bp/iNruPH9dso1Pn--