Releasing all outgoing ports for a particular IP.

[Lisa Muir]

On Thu, Feb 14, 2013 at 8:04 PM, Gary Palmer <gpalmer at freebsd.org> wrote:
> Hi Lisa,
>
> I believe you should look at PF tags.  If you tag the traffic coming in with
> the
>
> pass in on $vlan4_if proto tcp from $emailserver to any port $all_ports
>
> rule, you should then be able to use that in our ext_if rule to ensure
> only those packets are let out
>
> e.g.
>
> pass in on $vlan4_if proto tcp from $emailserver to any port $all_ports tag MAILSERVER
> pass out quick on $ext_if tagged MAILSERVER

excellent.... exactly what I was hoping for... and might even solve my
UDP dilemma.

I have

CC_UDP = "{15000:15200}"

and then a redirect rule:

rdr on $ext_if proto udp from any to $ext_if port $CC_UDP -> $lm_laptop

and then a pass rule to let it through:

pass quick proto udp from any to any port $CC_UDP

My initial instinct was to confine the pass rule from any to
$lm_laptop but the packets don't forward, presumably because UDP is
connectionless and bar the forward, there is nothing in the UDP
packets that specifies an ip based destination.

I'm going to try tagging these packets also and see if I can refine
the pass rule accordingly.

Big thanks for this heads up.

Lisa.