I think you've used "black_hole" and "black_whole" as table names. They should all be the same.
John On Wed, May 5, 2021, 5:18 AM Axel Rau <axel....@chaos1.de> wrote: > Hi all, > > in pf.conf, I have at the beginning: > - - - > table <black_hole> persist file "/etc/pf/black_hole.txt" > block drop in quick on $red_if from <black_whole> flags any > > fw1# pfctl -s rules | head -3 > block drop in quick on em2 from <black_whole> to any > > fw1# pfctl -t black_hole -T show > . . . > 146.168.0.0/16 > . . . > > But responses still going out from my ns: > > 0800 532: x.y.z.71.53 > 146.168.163.94.443: [udp sum ok] 1- 0/13/14(490) > (ttl 63, id 10399, len 518) > 0800 72: 146.168.163.94.443 > x.y.z.21.53: [no udp cksum] 1+ RRSIG? > pizzaseo.com.(30) (ttl 249, id 3922, len 58) > 0800 532: x.y.z.21.53 > 146.168.163.94.443: [udp sum ok] 1- 0/13/14(490) > (ttl 63, id 38336, len 518) > 0800 72: 146.168.163.94.443 > x.y.z.171.53: [no udp cksum] 1+ RRSIG? > pizzaseo.com.(30) (ttl 249, id 55913, len 58) > 0800 532: x.y.z.171.53 > 146.168.163.94.443: [udp sum ok] 1- 0/13/14(490) > (ttl 62, id 53578, len 518) > > > What is wrong in my setup? > > Thanks, Axel > --- > PGP-Key: CDE74120 ☀ computing @ chaos claudius > >
