On 2005-06-09 03:18, Matt Rechkemmer <[EMAIL PROTECTED]> wrote:
> On Tue, Jun 07, 2005 at 01:50:30PM +0300, Giorgos Keramidas wrote:
> >
> > We'd have to see the entire ruleset and a tcpdump of traffic that passes
> > through to know what's wrong.
> >
> > - Giorgos
>
> Here are the rules as taken from pfctl -sr. I can also provide a copy of
> pf.conf, if needed. The user's host is in the "badhosts" table. I've changed
> the first three octets of my IPs, for privacy reasons. The intruder's IP in
> the tcpdump has also been masked.
>
> ***sorry about the word wrap***
>
> scrub in all fragment reassemble
> block drop on fxp0 from <badhosts> to any
> block drop all
> pass out quick on lo0 all
> pass in quick on lo0 all
> pass out on fxp0 inet proto icmp all icmp-type echoreq code 0 keep state
> pass in on fxp0 inet proto icmp all icmp-type echoreq code 0 keep state
Rule matching in PF (as in IP Filter) is "last match wins".
The ICMP packets from <badhosts> entries match the following rules:
scrub in all fragment reassemble
block drop on fxp0 from <badhosts> to any
pass in on fxp0 inet proto icmp all icmp-type echoreq code 0 keep state
and the last rule wins...
If you add "quick" to the `block from <badhosts>' rule, packets from
these hosts will immediately be dropped -- which is what you probably
want to do, if I have understood what you wrote so far.
- Giorgos
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
