From owner-freebsd-questions@FreeBSD.ORG  Wed Oct  1 11:29:23 2003
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 0BCF916A4B3
	for <questions@freebsd.org>; Wed,  1 Oct 2003 11:29:23 -0700 (PDT)
Received: from firecrest.mail.pas.earthlink.net
	(firecrest.mail.pas.earthlink.net [207.217.121.247])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 0AE8243FE5
	for <questions@freebsd.org>; Wed,  1 Oct 2003 11:29:22 -0700 (PDT)
	(envelope-from algould@datawok.com)
Received: from 22-15.lctv-b4.cablelynx.com ([24.204.22.15]
	helo=yoda.datawok.com)
	by firecrest.mail.pas.earthlink.net with asmtp (TLSv1:RC4-MD5:128)
	(Exim 3.33 #1)	id 1A4lix-0007Vm-00; Wed, 01 Oct 2003 11:29:19 -0700
From: "Andrew L. Gould" <algould@datawok.com>
To: Gary <gv-list-freebsdquestions@mygirlfriday.info>,
	FreeBSD <questions@freebsd.org>
Date: Wed, 1 Oct 2003 13:29:23 -0500
User-Agent: KMail/1.5
References: <20031001181817.21832.qmail@letric.mygirlfriday.info>
In-Reply-To: <20031001181817.21832.qmail@letric.mygirlfriday.info>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200310011329.23459.algould@datawok.com>
X-ELNK-Trace: ee791d459e3d6817d780f4a490ca69564776905774d2ac4bca62d477ffd7d36d49e9f9db67257d78350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c
Subject: Re: Firewall problem
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 01 Oct 2003 18:29:23 -0000

On Wednesday 01 October 2003 01:18 pm, Gary wrote:
> I have set my firewall to
>
> firewall_type="open"
> firewall_enable="YES"
>
> and when I want to drop a specific IP, I enter it manually, it accepts it,
> but it does not drop the packets..
>
> I am getting a lot of virus activity on my SMTP port 25. So I wanted to
> drop a few IP ranges/addresses..
>
> 00100  62054   5483792 allow ip from any to any via lo0
> 00200      0         0 deny ip from any to 127.0.0.0/8
> 00300      0         0 deny ip from 127.0.0.0/8 to any
> 65000 873327 293931424 allow ip from any to any
> 65100      0         0 deny tcp from 24.92.226.153 to any
> 65110      0         0 deny ip from 213.191.102.86 to any
> 65535      0         0 deny ip from any to any
>
> Yet, checking later in my SMTP logs, I am still getting pounded by the
> listed addresses. Can anyone explain why this isn't working?
>
> Thanks,

I'm a newbie at firewalls; but I'll take a guess:  Doesn't rule 65000 let all 
ip packets in before rules 65100 and 65110 are considered?

Andrew