PF Firewall blocks packets which it should not

[jahlives]

Hi

I have a problem (again) with PF firewall. In my config file for the rules I have the following lines (among others)

table <homeLAN> const { 192.168.199.0/24, 192.168.200.0/24, 10.66.77.0/24, 127.0.0.1 }
pass in quick proto { udp tcp } from <homeLAN> to any port { 993 3483 9000 }
block in log quick proto { udp tcp } from any to any port { 137 138 139 445 993 3483 9000 }

so in my understanding every IP from <homeLAN>-table should be allowed to access those ports in the 2nd rule. But if I check the blocked pakets with $ tcpdump -n -e -ttt -i pflog0 I can see the following

00:00:00.484582 rule 40..16777216/0(match): block in on em1: 192.168.199.51.45641 > 192.168.200.203.9000: Flags [F.], seq 0, ack 2, win 3456, options [nop,nop,TS val 110843131 ecr 351052784], length 0
00:00:12.971526 rule 40..16777216/0(match): block in on em1: 192.168.199.51.45641 > 192.168.200.203.9000: Flags [.], ack 2, win 3456, options [nop,nop,TS val 110844638 ecr 351068344,[|tcp]>

the sending IP is within <homeLAN>-table but the pakets get dropped anyway. Am I missing an important point or why these pakets get blocked?

Thanks for any idea

tobi

 

[SirDice]

If you look closely the packets are a FIN/ACK and an ACK. It's possible there's no state for this connection or those packets arrived multiple times.

The pass rule accepts connections and keeps it's state, any packet that's not corresponding to the state is dropped.

 

[jahlives]

SOLVED:Hanging process

Hi SirDice

you're right it seems to have nothing to do with the pakets dropped by PF. After more checkings I saw that the client in question was already connected to the service (squeezeboxserver) by $ sockstat -4. But the client application always pretended to not be connected. I started the client app several time but no changes. Then I restartet the server app and the client had no problem anymore to connect. It seems that the old connection was hanging for some reason and only restart the server app dropped that connection and the client could connect again