☰

howto/OpenBGPD: pf.conf: specify 'no state' for transit traffic Make sure state tracking doesn't interfere with asymmetric routing. Some discussion regarding 'keep state (sloppy)' vs 'no state' etc.: https://marc.info/?l=openbsd-tech&m=172164054316207&w=2 'Re: cache route at pf state' https://marc.info/?l=openbsd-misc&m=129864698805368&w=2 'Re: Alternatives to PF pflow for people running BGP ?' https://marc.info/?l=openbsd-misc&m=138308640116288&w=2 'Re: General question about openbgpd and PF'

Štěpán Němec committed 2024-08-26 11:22:41 +0200 commit 139e96fa1d4e90a4afa2220aa8aefc0ec9e1cc9d

				howto/OpenBGPD.md
			
          @@ -81,7 +81,8 @@ pass in quick on my_dn proto tcp from <dn42peers> \

           # router itself; only dn42 transit and BGP sessions are allowed

           block in log quick on my_dn to {$dn42_self (my_dn)}

           pass out on my_dn from 192.168.42/24 nat-to $dn42_self

          -pass on my_dn from <dn42etc> to <dn42etc>

          +# 'no state' as we might not see both directions of transit traffic

          +pass on my_dn from <dn42etc> to <dn42etc> no state

           ```

           ## `/etc/bgpd.conf`

...	...	@@ -81,7 +81,8 @@ pass in quick on my_dn proto tcp from <dn42peers> \
81	81	# router itself; only dn42 transit and BGP sessions are allowed
82	82	block in log quick on my_dn to {$dn42_self (my_dn)}
83	83	pass out on my_dn from 192.168.42/24 nat-to $dn42_self
84		-pass on my_dn from <dn42etc> to <dn42etc>
	84	+# 'no state' as we might not see both directions of transit traffic
	85	+pass on my_dn from <dn42etc> to <dn42etc> no state
85	86	```
86	87
87	88	## `/etc/bgpd.conf`