Article View: bit.listserv.openbsd-pf
Article #173Re: I want to filter some/all inbound traffic twice
From: Daniel Hartmeier
Date: Fri, 05 Apr 2013 07:05
Date: Fri, 05 Apr 2013 07:05
12 lines
1435 bytes
1435 bytes
If you need NAT, you have to do that on the external interface, and it requires (implies, even) creating states. However, you can filter statelessly on the internal interface (the states won't match there (wrong direction, if-bound), dropping outgoing TCP RST, passing everything else. Sounds similar to what was done to ignore the great firewall of China, see http://www.cl.cam.ac.uk/~rnc1/ignoring.pdf :) HTH, Daniel
Technical Details
Message-ID:
<20130405064544.GC14007@insomnia.benzedrine.cx>Path:
arc1-ca.pugleaf.net!p18ni38390wiv.0!nntp.google.com!goblin3!goblin1!goblin.stu.neva.ru!news.glorb.com!npeer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrnReferences:
<20130405042101.GA96921@cskk.homeip.net>Show Full Headers
Complete Article Headers
X-Google-Thread: bffa70e3,829cb92077992198
X-Google-Attributes: gidbffa70e3,public,usenet
X-Google-NewGroupId: yes
X-Google-Language: ENGLISH,ASCII-7-bit
X-Received: by 10.180.86.38 with SMTP id m6mr392459wiz.0.1365145522679;
Fri, 05 Apr 2013 00:05:22 -0700 (PDT)
Path: arc1-ca.pugleaf.net!p18ni38390wiv.0!nntp.google.com!goblin3!goblin1!goblin.stu.neva.ru!news.glorb.com!npeer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrn
From: daniel@benzedrine.cx (Daniel Hartmeier)
Newsgroups: bit.listserv.openbsd-pf
Subject: Re: I want to filter some/all inbound traffic twice
Date: 5 Apr 2013 00:05:21 -0700
Organization: None
Lines: 12
Message-ID: <20130405064544.GC14007@insomnia.benzedrine.cx>
References: <20130405042101.GA96921@cskk.homeip.net>
NNTP-Posting-Host: localhost.newsguy.com
Mime-Version: 1.0
NNTP-Posting-Date: 5 Apr 2013 07:05:22 GMT
X-Received-Bytes: 1023
Content-Type: text/plain; charset=us-ascii