Ipf

[MichaelF]

Hello there!

While configuring my ipf firewall on FreeBSD 8.2 I've been stumped by the following problem:
after adding this line to my /etc/ipf.rules file

block out log first quick on dc0 all

(or ANY rule starting with block OUT)

ipf refuses any INBOUND connection on dc0, although ipfstat -ih doesn't display any rule mathes.

I'm trying to follow the configuration explained here:
http://www.freebsd.org/doc/handbook/firewalls-ipf.html

It says:

# Block and log only the first occurrence of everything
# else that's trying to get out.
# This rule implements the default block
block out log first quick on dc0 all

...but why does any rule with "block OUT" lead to refusing INBOUND packets?

Thank you in advance,
Michael

 

[SirDice]

...but why does any rule with "block OUT" lead to refusing INBOUND packets?

Because the block also blocks any SYN/ACKs being sent back.

 

[MichaelF]

Thank you very much!

Michael