Re: packet filter: question about parentheses around "self"

2014-10-10 Thread Harald Dunkel
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 10/08/14 21:44, Henning Brauer wrote: > * Harald Dunkel [2014-10-07 13:46]: >> A related question: I wonder how well "(self)" and "(group)" perform, >> compared to tables listing IP addresses? Is (self) evaluated every time for >> each rule usi

Re: packet filter: question about parentheses around "self"

2014-10-08 Thread Henning Brauer
* Harald Dunkel [2014-10-07 13:46]: > A related question: I wonder how well "(self)" and "(group)" > perform, compared to tables listing IP addresses? Is (self) > evaluated every time for each rule using it, once per connection, > in certain intervals, or only if one of the network interfaces > ar

Re: packet filter: question about parentheses around "self"

2014-10-07 Thread Harald Dunkel
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hi folks, On 10/07/14 05:12, Giancarlo Razzolini wrote: > On 04-10-2014 11:06, Peter N. M. Hansteen wrote: >> The parentheses denote potentially dynamic addresses, and IIRC the main >> difference is that with parentheses the list will be expanded I

Re: packet filter: question about parentheses around "self"

2014-10-06 Thread Giancarlo Razzolini
On 04-10-2014 11:06, Peter N. M. Hansteen wrote: > The parentheses denote potentially dynamic addresses, and IIRC the > main difference is that with parentheses the list will be expanded > IIRC at rule evaluation time, while without the parentheses, the list > of addresses is expanded at ruleset lo

Re: packet filter: question about parentheses around "self"

2014-10-04 Thread Peter N. M. Hansteen
Harald Dunkel writes: > Pf question about parentheses around "self": Does "(self)" > work similar to "(egress)"? pf.conf(5) describes parentheses > around interface names and interface groups, but "self" is > not mentioned: The parentheses denote potentially dynamic addresses, and IIRC the main

packet filter: question about parentheses around "self"

2014-10-04 Thread Harald Dunkel
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hi folks, Pf question about parentheses around "self": Does "(self)" work similar to "(egress)"? pf.conf(5) describes parentheses around interface names and interface groups, but "self" is not mentioned: address= ( interface-name | interfac