> > email server monowall cisco adsl
> > 192.168.0.1----192.168.0.254(sis0) / 10.0.0.1(sis1) --
> > Incoming connection from rule
> > pass in log quick proto tcp from 192.148.x.x/32 to 192.168.0.1/32 port =
> > keep state group 200
> > But email server syn-ack is blocked by sis0
> But these are for different source ports. Do you have any cases where the
> SYN/ACK is blocked to the *same* port that sent the SYN?
Yes, we have. Two passed entries from internet to lan and one blocked from
lan to internet
sis1 @200:1 p 192.148.x.x,51256 -> 192.168.0.1,25 PR tcp len 20 48 -S K-S IN
sis0 @200:1 p 192.148.x.x,51256 -> 192.168.0.1,25 PR tcp len 20 48 -S K-S
sis0 @0:17 b 192.168.0.1,25 -> 192.148.x.x,51256 PR tcp len 20 48 -AS IN
The problem is only with incoming mail.
> > Rule 17 is the default rule
> > block in log quick proto tcp from any to any
> Yes, and it shouldn't be reached for a packet with a matching state entry.