pf misfeature

[Max Laier]

On Thursday 08 November 2007, Dag-Erling Smørgrav wrote:
> Max Laier <max at love2party.net> writes:
> > On Thursday 08 November 2007, Dag-Erling Smørgrav wrote:
> >> but what you actually get is this:
> >>
> >>   pass on $eth from $lan to $lan flags S/SA keep state
> >>
> >> which only matches TCP handshakes, so your UDP streams are screwed.
> >
> > I don't think this is true.
>
> With "pass on $eth from $lan to $lan", NFS doesn't work.  With "pass on
> $eth inet proto { tcp, udp } from $lan to $lan", it does.

Works for me.  I can NFS over UDP in both directions with the following 
rules (expanded):

block drop log all
pass log on bge0 from (bge0:network) to (bge0:network) flags S/SA keep 
    state

-- 
/"\  Best regards,                      | mlaier at freebsd.org
\ /  Max Laier                          | ICQ #67774661
 X   http://pf4freebsd.love2party.net/  | mlaier at EFnet
/ \  ASCII Ribbon Campaign              | Against HTML Mail and News
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part.
Url : http://lists.freebsd.org/pipermail/freebsd-net/attachments/20071108/9b2e12c7/attachment.pgp