Re: strange results with pf

On Wed, Aug 20, 2003 at 01:57:37PM +0400, Alexei G. Malinin wrote:

> I scanned from separate host.

Then make sure the nmap probes actually get sent by that host (if that host is also running a packet filter, that's not a safe assumption), tcpdump on its external interface.

Then tcpdump on the pf box' external interface, do you see the probes arrive? If so, do you see any replies sent by the pf box? If not (and only in this case) you can start to debug the ruleset.

Add 'log' to all block and scrub rules. Scrubbing comes first, if the scrubber drops an incoming probe (due to invalid xmas flags), it will just drop the packet, and your 'block return-icmp' rule is irrelevant.

Make sure pflogd is running and check /var/log/pflog.

Daniel Received on Wed Aug 20 06:38:00 2003

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related openbsd.org Links advocacy announce bugs ipv6 misc ports ports-changes security-announce smp source-changes tech Request more information about Pantek