Re: strange results with pf

On Wed, Aug 20, 2003 at 01:26:35PM +0400, Alexei G. Malinin wrote:

> The talk is about all protocols (not only tcp) and protocol scanning by

Make sure you are scanning from a separate host. Running nmap on the firewall itself (against one of its own addresses or another host) will cause EHOSTUNREACH errors from the stack when pf blocks outgoing packets (like, when you allow only flags S/SA to create state and block by default, but nmap tries to send ACK, SYN+ACK or xmas flags).

Daniel Received on Wed Aug 20 06:08:54 2003