I know ipf (the predecessor to pf) had a "keep state" option so that traffic
originating from the machine could get back in. Maybe try taking a look at that
option and see if it helps.
> Just tried it: Doesn't work :-(
> In fact, that line you refered to was added after the fact.
> After I realized the enc0 line wouldn't work. I commented
> the whole line out and it still chokes. I set up a ping
> on my notebook with your suggestion, and here is what
> the logs say (trimmed down).
>
> rule 2/0(match): block in on enc0: 192.168.3.2 > 192.168.2.202: icmp: echo reply (encap)
>
> The traffic gets out, but not back in. That is the part I do not
> understand.
>
> On Mon, Mar 18, 2002 at 10:51:13AM -0700, J.Francois wrote:
>
> You have a rule that blocks all incoming RFC1918 addresses.
> Remove the "quick" on:
>
> > block in log quick on xl0 from {10.0.0.0/8, 172.16.0.0/12, \
> > 192.168.0.0/16, 255.255.255.255/32} to any
>
> and lets see what happens.
> Getting rid of "quick" will let you fall thru the rest of your rules.
> IIRC the physical interface gets handled before the tunneled interface.
>
>
> On Mon, Mar 18, 2002 at 12:15:11PM -0500, Mike wrote:
> > In setting up IPSec on some OpenBSD boxes, I have
> > noticed that I can not use a statement to pass traffic
> > on the enc0 in ONLY from a certain network. See my pf
> > rules below:
> > --------------------------------------------------------
> > SCOTT_OFFICE = "XXX.XXX.XXX.XXX"
> >
> > scrub in on xl0 all
> > scrub in on enc0 all
> >
> > block in log from any to any
> > block out log from any to any
> >
> > block in quick on xl0 from any to 255.255.255.255
> > block in log quick on xl0 from {10.0.0.0/8, 172.16.0.0/12, \
> > 192.168.0.0/16, 255.255.255.255/32} to any
> >
> > pass in on enc0 from any to any
> > pass out quick on enc0 from 192.168.3.0/24 to 192.168.2.0/24
> > #pass in quick on enc0 from 192.168.2.0/24 to 192.168.3.0/24
> >
> > pass in quick on fxp0 from 192.168.3.0/24 to any keep state
> > pass out quick on fxp0 from 192.168.2.235 to 192.168.3.13
> > pass out quick on fxp0 from 192.168.2.202 to 192.168.3.2
> >
> > pass in quick on xl0 proto udp from $SCOTT_OFFICE to xl0 port = 500
> > pass out quick on xl0 proto udp from xl0 to $SCOTT_OFFICE port = 500
> >
> > pass in on xl0 proto esp from $SCOTT_OFFICE to xl0
> > pass out on xl0 proto esp from xl0 to $SCOTT_OFFICE
> > ----------------------------------------------------------------
> > Notice the commented line for the enc0 interface. I have tried
> > changing the line, but it will not work. These rules function
> > similar on both sides (work & home). It only chokes on the "in"
> > rules, not the "out".
> >
> > Can anyone explain this behavior to me?
> --
> Jean Francois - JLF Sends... /"\
> "Tell them we are not Gods, but SysAdmins, which is the next best thing." \ / ASCII Ribbon Campaign
> Getting Facts - $35: http://www.winface.com/blurb.html X Against HTML Mail
> Getting Certs - $40: http://www.brainbench.com/transcript.jsp?pid=1214021 / \
> Getting Published - Priceless: http://www.informit.com/authors/index.asp?authorid={6AD44647-E752-4CAB-B911-D3246F294DBA}
>
> ________________________________________________
> See http://PLUG.phoenix.az.us/navigator-mail.shtml if your mail doesn't post to the list quickly and you use Netscape to write mail.
>
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
> ________________________________________________
> See http://PLUG.phoenix.az.us/navigator-mail.shtml if your mail doesn't post to the list quickly and you use Netscape to write mail.
>
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
(text/plain)