Re: Understanding if-bound vs floating state policy

--1LKvkjL3sHcu1TtY
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Alexandr Nedvedicky wrote:

[dd]

> > Why is this state not permitting the reversed packets (echo
> > replies) from 172.16.1.10 to 192.168.10.3 incoming via the "dmz" interf=
ace?
> >=20
> > It is my understanding that with the default "state-policy=3Dfloating",
> > reversed packets should be passed from 172.16.1.10 to 192.168.10.3,
> > but it is not happening.
> >=20
> > This behaviour would be expected with "state-policy=3Dif-bound", but
> > with "state-policy=3Dfloating" shouldn't the states be global?
> >=20
> > What am I missing?=20
>=20
>     according to my understanding the state got created by
>     inbound rule bound to 'inside' interface.=20


Correct. That was my intention.

> Such state allows
>     further packets:
>=20
> 	192.168.10.3 -> 172.16.1.10  @ inbound
> 	172.16.1.10  -> 192.168.10.3 @ outbound

Well, if the "pfctl -vvs state" showed those inbound and outbound
markers, I would have probably suspected something. Unfortunately it
presents the state as "all."

>=20
>     these are all packets, which are allowed by by state created
>     by your 'pass in' rule.
>=20
>     The forwarding essentially means the packets cross two interfaces.
>     It means the PF running on your host sees the packet two times.=20


This is certainly true for pf rules. However, states are processed
before rules, arent't they?


>     time the packet is seen as inbound second time it is seen as outbound.

Seen by the rules, yes. But isn't the state table supposed to be checked
*before* rules?

>     For ICMP requests story goes like this:
>=20
> 	192.168.10.3 -> 172.16.1.10  @ inbound
> 	192.168.10.3 -> 172.16.1.10  @ outbound
>=20
>     for ICMP replies:
> 	172.16.1.10  -> 192.168.10.3 @ inbound
> 	172.16.1.10  -> 192.168.10.3 @ outbound
>=20
>     Now it should become obvious your firewall is missing state, which al=
lows
>     replies. There is no state, which allows inbound ICMP reply, and ther=
e is
>     no such rule, which allows inbound ICMP rule.

I see now. The state-policy=3Dfloating mislead me into believing that the=
=20
state table was global. Thank you for explaining.

But then, what is the real difference betwttn if-bound and global?


--=20
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
2:5005/49@fidonet http://vas.tomsk.ru/

--1LKvkjL3sHcu1TtY
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEcBAEBAgAGBQJd84qaAAoJEA2k8lmbXsY0WJkIAJ8OM1JAvCNKQk/zXHSn0PYo
ohBag9K0bdiPxn1U59XMcrI/O2PwsMTL0S+zLZboOuAd8dvva/l5+nF/XcLbQMBH
zuuk24M56IKW6oI/4G1t6FH73xwmOxyZpfRMB2zRz6DTeoKn3YtE88NNVY5yFhuk
wds2Mj5WxRiRYoXqqQhHsxIDspcKfT5bZ/GGQTzhE1AMcw3B63jeTp3exGkkrXVs
pNVCSIkTDQ1dgTxJIyVGDtSMCVpeA0FRPf1V8z65gBi9SjqjtqxO5lGavy139MHr
gl5/KC6vjStldAaJqRGgFLKzW7LQubx5NYoqJaXLBNWFRkp7GTpN5A3jzxpF+oY=
=N2Z5
-----END PGP SIGNATURE-----

--1LKvkjL3sHcu1TtY--