From owner-freebsd-pf@FreeBSD.ORG Fri May 16 02:19:49 2008 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 732A8106567B for ; Fri, 16 May 2008 02:19:49 +0000 (UTC) (envelope-from m.pagulayan@auckland.ac.nz) Received: from mailhost.auckland.ac.nz (curly.its.auckland.ac.nz [130.216.12.33]) by mx1.freebsd.org (Postfix) with ESMTP id 09FDD8FC18 for ; Fri, 16 May 2008 02:19:48 +0000 (UTC) (envelope-from m.pagulayan@auckland.ac.nz) Received: from localhost (localhost.localdomain [127.0.0.1]) by mailhost.auckland.ac.nz (Postfix) with ESMTP id 7A8659C434; Fri, 16 May 2008 14:19:47 +1200 (NZST) X-Virus-Scanned: by amavisd-new at mailhost.auckland.ac.nz Received: from mailhost.auckland.ac.nz ([127.0.0.1]) by localhost (curly.its.auckland.ac.nz [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XeTg8oCV-tY2; Fri, 16 May 2008 14:19:47 +1200 (NZST) Received: from UXCHANGE2.UoA.auckland.ac.nz (uxcn2.itss.auckland.ac.nz [130.216.190.119]) by mailhost.auckland.ac.nz (Postfix) with ESMTP id 31D9B9C3ED; Fri, 16 May 2008 14:19:46 +1200 (NZST) Received: from UXCHANGE1.UoA.auckland.ac.nz ([130.216.190.118]) by UXCHANGE2.UoA.auckland.ac.nz with Microsoft SMTPSVC(6.0.3790.1830); Fri, 16 May 2008 14:19:43 +1200 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Fri, 16 May 2008 14:13:22 +1200 Message-ID: In-Reply-To: <482CE06D.7070800@uffner.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: FreeBSD PF 4.1 Inserts Flags S/SA Automatically to rules Thread-Index: Aci28oIbiuQOSYiWS0W6BnZ63jzGiQABuVAg References: <482B7BE6.9080608@uffner.com><482B80D3.4010701@quis.cx> <482B9117.9070800@uffner.com> <482C7056.7010809@uffner.com> <482CE06D.7070800@uffner.com> From: "Mark Pagulayan" To: "Tom Uffner" X-OriginalArrivalTime: 16 May 2008 02:19:43.0926 (UTC) FILETIME=[4DDA5560:01C8B6FB] Cc: freebsd-pf@freebsd.org Subject: RE: FreeBSD PF 4.1 Inserts Flags S/SA Automatically to rules X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 May 2008 02:19:49 -0000 Hi Tom, Thanks heaps for the advice I will review and reorganize our ruleset.=20 Cheers,=20 Mark -----Original Message----- From: Tom Uffner [mailto:tom@uffner.com]=20 Sent: Friday, 16 May 2008 1:16 p.m. To: Mark Pagulayan Cc: freebsd-pf@freebsd.org Subject: Re: FreeBSD PF 4.1 Inserts Flags S/SA Automatically to rules Mark Pagulayan wrote: > Yes I am using net.link.bridge.pfil_member: 1. What is the effect of > this on the bridge interface.=20 see if_bridge(4) for full details. in short they control whether or not filtering is available on the member interfaces and/or the bridge. net.link.bridge.pfil_local_phys: 0 net.link.bridge.pfil_member: 1 net.link.bridge.pfil_bridge: 1 net.link.bridge.pfil_onlyip: 1 > No there is no such rules below in my ruleset > # is there a "set skip on {lo0, bridge0}" in here somewhere >=20 > Is PF by default doing a filter on bridge0? What is the effect of this > rule on the bridge?=20 i realized too late that you don't need one. i expected to see such a rule due to my style of ruleset writing. i usually start w/ "block log all" to disable the default pass rule on all interfaces, then explicitly allow only the traffic i want. you didn't, so the default for interfaces you don't have any rules for is pass all. "set skip on X" has the same effect as a rule that says "pass quick on X"