Subject: confusing pf behaviour, block drop still returns messages?
To: None <>
From: Nino Dehne <>
List: tech-net
Date: 04/12/2006 01:57:30

consider the following setup

Internet <-> [pppoe0]gw-ext[sip1] <-> [sip2]gw[vlan1] <-> LAN

pppoe0: public address
a client in LAN:

gw-ext utilises a pf(4) ruleset that - among other things - blocks bogon
and RFC1918 networks on pppoe0 in both directions:

>>> pf.conf
set block-policy drop
# don't rewrite to/from <evil>, saves a state entry and gets squashed below
# in filter rules
no nat on $ext_if inet from any to <evil>
no rdr on $ext_if inet from <evil> to any
block in log quick on $ext_if inet from any to <evil>
block in log quick on $ext_if inet from <evil> to any
block return-icmp(13) out log quick on $ext_if inet from any to <evil>
block return-icmp(13) out log quick on $ext_if inet from <evil> to any
<<< pf.conf

The idea is to silently drop everything that originates outside our network
in order to not generate traffic to known invalid/bogus destinations,
but to be so kind and return an error for local networks to aid debugging.

However, when I tcpdump on interface vlan1 on host gw, I see two errors:

01:03:00.296138 IP > icmp 36: host unreachable - admin prohibited filter
01:03:00.296352 IP > icmp 36: host unreachable

The first is expected, the second isn't. The second message even persists
when I remove the return-icmp(13). At that point gw-ext shouldn't emit error
messages because of the default block-policy.

I also noticed that, when I try to ping the host directly from gw-ext
I get a confusing error message:

# ping
PING ( 56 data bytes
ping: sendto: No route to host

This is plain wrong. First, there is a route to that network in the routing
table. Second, I even get that message when I tell pf to silently block and
not return anything.

What is going on here? To me, this is not consistent behaviour at all. How
can I get a nice "admin prohibited" error while shutting up pf about the
normal unreachable which I think shouldn't be there in the first place?


Best regards,