From owner-freebsd-questions  Tue Dec 17  5:32:38 2002
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 4771137B401
	for <freebsd-questions@freebsd.org>; Tue, 17 Dec 2002 05:32:37 -0800 (PST)
Received: from cactus.fi.uba.ar (cactus.fi.uba.ar [157.92.49.108])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 3B24543EA9
	for <freebsd-questions@freebsd.org>; Tue, 17 Dec 2002 05:32:36 -0800 (PST)
	(envelope-from fgleiser@cactus.fi.uba.ar)
Received: from cactus.fi.uba.ar (cactus.fi.uba.ar [157.92.49.108])
	by cactus.fi.uba.ar (8.12.3/8.12.3) with ESMTP id gBHDWetU061412;
	Tue, 17 Dec 2002 10:32:40 -0300 (ART)
	(envelope-from fgleiser@cactus.fi.uba.ar)
Date: Tue, 17 Dec 2002 10:32:40 -0300 (ART)
From: Fernando Gleiser <fgleiser@cactus.fi.uba.ar>
To: =?iso-8859-1?q?Keith=20Spencer?= <bsd2000au@yahoo.com.au>
Cc: fbsd <freebsd-questions@freebsd.org>
Subject: Re: ipf -> IPFILTER_DEFAULT_BLOCK ...This is not working as predicted!
 Help?
In-Reply-To: <20021217122916.61123.qmail@web12002.mail.yahoo.com>
Message-ID: <20021217102839.C52840-100000@cactus.fi.uba.ar>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Spam-Status: No, hits=-103.4 required=5.0
	tests=IN_REP_TO,SUBJ_ENDS_IN_Q_MARK,PLING,USER_IN_WHITELIST
	version=2.31
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

On Tue, 17 Dec 2002, Keith Spencer wrote:

> Hi all,
> Marty Schlacter is obviously the man. I am following
> his firewall tute religiously but I am doing something
> wrong!
> I have an ipf.rules EXACTLY like his. Works a
> treat...but only if I remove the kernel
> ipfilter_default_block option.
> If it is in there...it blocks way too well.
> Everything.
> What is going on here or has Marty got it all wrong?

Are you using the 'quick' keyword? If you don't, ipf uses a last-match
checking, and the last rule is 'block all'

See the IPF HOWTO for details.


			Fer

> Thanks Keith
>
> http://greetings.yahoo.com.au - Yahoo! Greetings
> - Send your seasons greetings online this year!
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-questions" in the body of the message
>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message