Remote host replies to SYN+FIN

[Michael Powell]

kalin m wrote:

> 
> does anybody have any idea how to resolve this?
> 
[snip]

Not without a lot more information. But I may be able to fathom some wild
guess, generically speaking.

Only allow connections to set up like this:

pass out quick on $ExtIF inet proto tcp  all flags S/SA keep state

pass in quick on $ExtIF inet proto tcp from any to any port 48080 flags S/SA
keep state

Notice I included the "keep state" for illustrative purposes. With the
latest version of pf this is now the default condition and including it is
no longer required.

Then either block the SYN+FIN before they reach these rules, or simply allow
it to fall through to a generic dumping rule like this:

block in quick log on $ExtIF all

This way the SYN+FIN doesn't match the rules for legitimate traffic
and "falls through" to default block all "non-legitimate" traffic.

YMMV - Mike