title: How to filter TCP packets based on flags using Packet Filter in OpenBSD
body: <p>Well, I didn't know exactly how to ask this question, but I know that you can use the keyword <em>flags</em> to especify which flags you want to filter.</p>
  
  <p>According to the documentation of the Packet filter:</p>
  
  <blockquote>
    <p>To have PF inspect the TCP flags during evaluation of a rule, the
    flags keyword is used with the following syntax:</p>
    
    <p>flags check/mask<br>
    flags any </p>
    
    <p>The mask part tells PF to only inspect the
    specified flags and the check part specifies which flag(s) must be
    "on" in the header for a match to occur. Using the any keyword allows
    any combination of flags to be set in the header.</p>
    
    <p>pass in on fxp0 proto tcp from any to any port ssh flags S/SA<br>
    pass in on fxp0 proto tcp from any to any port ssh </p>
    
    <p>As flags S/SA is set by
    default, the above rules are equivalent, Each of these rules passes
    TCP traffic with the SYN flag set while only looking at the SYN and
    ACK flags. A packet with the SYN and ECE flags would match the above
    rules, while a packet with SYN and ACK or just ACK would not.</p>
  </blockquote>
  
  <p>So, I understood the example and why the packet with the flags S and E can pass (because the E flag is not considered due to the mask SA) and why the packet with only the Ack flag can't pass the firewall. </p>
  
  <p>What I didn't understand is why the packet with the flags S and A can't pass the rule S/SA, if the flag S is "on" in the packet header. Maybe the documentation is ambiguous? Sorry if this is a stupid question or an english misunderstood.</p>
  
  <p>I imagine that it can only pass if it MUST HAS <strong>ONLY</strong> the flag S.
  In set arithmetic would be something like this:</p>
  
  <p><strong>flag(s) must be 'on' in the header</strong> -> <strong>flag(s) pertains to the masked subset</strong> [pf doc]<br>
  <strong>only the flag(s) must be 'on' in the header</strong> -> <strong>flag(s) is egual to the masked subset</strong> [what I understood from the example given]</p>
  
  <p>Thanks in advance!</p>