Hi Tom, Thanks heaps for the advice
I will review and reorganize our ruleset. Cheers, Mark -----Original Message----- From: Tom Uffner [mailto:[EMAIL PROTECTED] Sent: Friday, 16 May 2008 1:16 p.m. To: Mark Pagulayan Cc: freebsd-pf@freebsd.org Subject: Re: FreeBSD PF 4.1 Inserts Flags S/SA Automatically to rules Mark Pagulayan wrote: > Yes I am using net.link.bridge.pfil_member: 1. What is the effect of > this on the bridge interface. see if_bridge(4) for full details. in short they control whether or not filtering is available on the member interfaces and/or the bridge. net.link.bridge.pfil_local_phys: 0 net.link.bridge.pfil_member: 1 net.link.bridge.pfil_bridge: 1 net.link.bridge.pfil_onlyip: 1 > No there is no such rules below in my ruleset > # is there a "set skip on {lo0, bridge0}" in here somewhere > > Is PF by default doing a filter on bridge0? What is the effect of this > rule on the bridge? i realized too late that you don't need one. i expected to see such a rule due to my style of ruleset writing. i usually start w/ "block log all" to disable the default pass rule on all interfaces, then explicitly allow only the traffic i want. you didn't, so the default for interfaces you don't have any rules for is pass all. "set skip on X" has the same effect as a rule that says "pass quick on X" _______________________________________________ freebsd-pf@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-pf To unsubscribe, send any mail to "[EMAIL PROTECTED]"
