From owner-freebsd-pf@FreeBSD.ORG Wed Feb 15 09:11:58 2012 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id F3182106566B for ; Wed, 15 Feb 2012 09:11:58 +0000 (UTC) (envelope-from ml@my.gd) Received: from mail-bk0-f54.google.com (mail-bk0-f54.google.com [209.85.214.54]) by mx1.freebsd.org (Postfix) with ESMTP id 78B8F8FC17 for ; Wed, 15 Feb 2012 09:11:58 +0000 (UTC) Received: by bkcjg1 with SMTP id jg1so908246bkc.13 for ; Wed, 15 Feb 2012 01:11:55 -0800 (PST) Received: by 10.205.117.141 with SMTP id fm13mr10747354bkc.133.1329297114980; Wed, 15 Feb 2012 01:11:54 -0800 (PST) Received: from dfleuriot-at-hi-media.com ([83.167.62.196]) by mx.google.com with ESMTPS id y9sm5150281bkw.5.2012.02.15.01.11.53 (version=SSLv3 cipher=OTHER); Wed, 15 Feb 2012 01:11:54 -0800 (PST) Message-ID: <4F3B76DB.1040301@my.gd> Date: Wed, 15 Feb 2012 10:11:55 +0100 From: Damien Fleuriot User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:10.0) Gecko/20120129 Thunderbird/10.0 MIME-Version: 1.0 To: freebsd-pf@freebsd.org References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Gm-Message-State: ALoCoQnKLLm7p0oYsCtkmlmbTKawKjGrDktAFIIyMaX/TW/tGYOjcLM4K6psnfbZAS+a/mryDdYj Subject: Re: Differences in PF between FBSD 8.2 & 9.0? X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Feb 2012 09:11:59 -0000 On 2/15/12 2:22 AM, Doug Sampson wrote: > I got bitten by PF when upgrading from 8.2 to 9.0. It refused to allow > any incoming mail. I'm using spamd in conjunction with pf. I use a > combination of natting along with redirections in conjunction with the > normal pass/block rules. > Toggle logging on both your default drop rule and your allow mail ones. Then tcpdump -nei pflog0 ip and port 465 (or 25, whichever) See what rule number matches your packets, then find out what rule that is with pfctl -vvvsr There hasn't been a syntax change from 8.2 to 9.0, however I think that's planned for 10.0