Re: can I use keep-state for icmp rules?

From: Crist J. Clark (
Date: 10/31/01

Date: Wed, 31 Oct 2001 13:14:34 -0800
From: "Crist J. Clark" <>

On Thu, Nov 01, 2001 at 01:26:21AM +1000, David Trzcinski wrote:

> i dont use keep-state for my tcp either, with
> ipfw add allow tcp from any to any out via <interface>
> ipfw add allow log tcp from any to any 80 in via <interface> setup
> ipfw add allow tcp from any to any in via <interface> connected
> ipfw add deny log tcp from any to any in via <interface>
> which, as far as i know should stop the problems mentioned with useing
> keepstate..
> if i'm wrong, please tell me :)

Doing a stateless packet filter for TCP has some problems. It is
trivial to scan for the topology of the network behind the firewall
for example. It is possible to fingerprint network stacks to some
extent through a stateless packet filter.

Crist J. Clark                 
To Unsubscribe: send mail to
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • Re: freebsd 6.2 with ipfw forward not working
    ... dmcs> Hi, ... dmcs> tcp port 80 to a local squid server. ... dmcs> ipfw rules ... ipfw fwd,3128 log tcp from to any 80 ...
  • Re: multiple natd + ipfw, with 2 internal ips
    ... I have a little problem with my natd or ipfw configuration. ... Well you could if you set your internal interface to be in promiscuous mode and set proxy arp for that address ... is the next hop router, it uses ARP to find the MAC address of this router. ...
  • RE: Which interface do I put natd and ipfw
    ... You only NAT the public internet facing interface, ... You should turn on user ppp -nat function and not use the ipfw ... public internet use keep-state. ... All rules use via interface name to specify the interface the ...
  • Re: Freebsd IP Forwarding performance (question, and some info) [7-stable, current, em, smp]
    ... All incoming traffic from any particular interface is still serialized though. ... I've really only focused on local traffic performance with my 10gbps Chelsio setup, it should be possible to do packet forwarding from multiple input queues using that hardware and driver today. ... However, these necessarily take a cache miss or two on packet header data in order to break out the packets from the input queue into flows that can be processed independently without ordering constraints, so if those cache misses on header data are a big part of the performance of a configuration, load balancing in this manner may not help. ... Maximum PPS with one ipfw rule on UP: ...
  • pf.conf
    ... Use "block return" so that a TCP RST is sent ... to $Angels port ssh ... # Pass TCP, UDP, and ICMP out on the external interface. ... pass out on $Demons proto all modulate state ...