[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Curious about interactions with pf and some file sharing programs

On Tue, Oct 15, 2002 at 03:37:56PM -0400, William Culler wrote:
> > Yes, the 'keep state' option in that rules allows replies to your
> > outgoing UDP packets.
> I figured that was the case, but I just wanted to verify.  I definitely
> want to continue using "keep state" on outgoing UDP traffic so I decided
> to install a software firewall on the particular Windows machine that I
> use Kazaa on and block the incoming UDP packets there.  Thanks for the
> reply.
Of course you don't need to 'keep state' on all outgoing connections, if
you don't want the replies. You can use different 'pass out' rules for
different traffic, and each can 'keep state' enabled or not.
For instance, if all you want is DNS,
  pass out on $ext_if proto udp from any to any port domain keep state
is sufficient, and will let DNS queries out and associated replies back
in, while not allowing any other UDP traffic in or out (which would be
blocked by a default block, if there are no other rules allowing it).
I don't think you ever need to pass any traffic at the border gateway
just to drop it at the final destination, you can just as well drop it
at the border.