[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

pf and pmtu discovery



Lars Weste wrote:

with scrub in all set at the firewall, will openbsd handle icmp packets of type unreach code needfrag automatically, because of the statefulness?
as far as i know, icmp packtes like port/host/network unreachable are allowed by the keep state statements, does this also apply for the need fragment codes of icmp unreachable messages?


or shall I have to add a rule to allow these packets explicitly?

citating pf.conf(5):

...

STATEFUL INSPECTION

...

     ICMP messages fall into two categories: ICMP error messages, which always
     refer to a TCP or UDP packet, are matched against the referred to connec-
     tion.  If one keeps state on a TCP connection, and an ICMP source quench
     message referring to this TCP connection arrives, it will be matched to
     the right state and get passed.

...