From owner-freebsd-pf@FreeBSD.ORG Sun May 25 08:39:54 2008 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 40AB9106567B for ; Sun, 25 May 2008 08:39:54 +0000 (UTC) (envelope-from ighighi@gmail.com) Received: from rv-out-0506.google.com (rv-out-0506.google.com [209.85.198.227]) by mx1.freebsd.org (Postfix) with ESMTP id 1B0F98FC1B for ; Sun, 25 May 2008 08:39:54 +0000 (UTC) (envelope-from ighighi@gmail.com) Received: by rv-out-0506.google.com with SMTP id l9so1734300rvb.1 for ; Sun, 25 May 2008 01:39:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; bh=Z15Cws9MtpaZKw4bCBJBeeS/oQ+VsBKGSPZwhOn4dDM=; b=tcEgdUazbVfTeZLcwWkgmbIvCxH4hWCwzRbEZS4wHoJHv33fPePvaa//edF9OZc+See0S0UzkiLIzQlPEDwB9FcIeP47hu8z5vms3aaKT9mmIl7fjRI9MTrMYoqcfX2DLYj5PlR82UQ23LJ2it1bP8XV0E1MdHLoHpQi1vMXFFw= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=K0rA5hw5wNrSkZMqQZXBs6M86/a2K8zVkq0bIFkjR0H6s8BKUoa8AZBZoOqzWuA2/HUxQQcg4jrzLIjTHUBlRJTqvUdabOTjCR1buGcsa/W14adxGWMGC9H/azwGxWPTdzX+VzWUd4FAjwuq1mI1F4f7EPb6cmOsHKfdzGwAVGE= Received: by 10.141.203.7 with SMTP id f7mr1574464rvq.7.1211703259499; Sun, 25 May 2008 01:14:19 -0700 (PDT) Received: by 10.141.76.1 with HTTP; Sun, 25 May 2008 01:14:19 -0700 (PDT) Message-ID: Date: Mon, 26 May 2008 03:44:19 +1930 From: "Ighighi Ighighi" To: freebsd-pf@freebsd.org. MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline Cc: Subject: blackhole in PF possible? X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 25 May 2008 08:39:54 -0000 blackhole(4) is hardly a feature if it applies to loopback interfaces as well. Its intended functionality ("to slow down anyone who is port scanning a system", according to the manpage) also slows down internal services because those TCP RST's and ICMP Port Unreachable's are never seen. Is there a way to get the same functionality in PF so I can restrict those packets to external interfaces ? Thanks in advance, Igh.