From owner-freebsd-questions@FreeBSD.ORG Thu Jun 9 10:51:24 2005 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3F23216A420 for ; Thu, 9 Jun 2005 10:51:24 +0000 (GMT) (envelope-from keramida@ceid.upatras.gr) Received: from aiolos.otenet.gr (aiolos.otenet.gr [195.170.0.93]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8520243D4C for ; Thu, 9 Jun 2005 10:51:22 +0000 (GMT) (envelope-from keramida@ceid.upatras.gr) Received: from orion.daedalusnetworks.priv (aris.bedc.ondsl.gr [62.103.39.226]) by aiolos.otenet.gr (8.13.4/8.13.4/Debian-1) with SMTP id j59ApHhY024938; Thu, 9 Jun 2005 13:51:17 +0300 Received: from orion.daedalusnetworks.priv (orion [127.0.0.1]) by orion.daedalusnetworks.priv (8.13.4/8.13.4) with ESMTP id j59ApHMZ090536; Thu, 9 Jun 2005 13:51:17 +0300 (EEST) (envelope-from keramida@ceid.upatras.gr) Received: (from keramida@localhost) by orion.daedalusnetworks.priv (8.13.4/8.13.4/Submit) id j59ApHe1090519; Thu, 9 Jun 2005 13:51:17 +0300 (EEST) (envelope-from keramida@ceid.upatras.gr) Date: Thu, 9 Jun 2005 13:51:16 +0300 From: Giorgos Keramidas To: Matt Rechkemmer Message-ID: <20050609105116.GA87877@orion.daedalusnetworks.priv> References: <20050607064323.GA29038@sdf.lonestar.org> <20050607105030.GA44218@orion.daedalusnetworks.priv> <20050609101805.GA11341@sdf.lonestar.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20050609101805.GA11341@sdf.lonestar.org> Cc: freebsd-questions@freebsd.org Subject: Re: pf block question X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Jun 2005 10:51:24 -0000 On 2005-06-09 03:18, Matt Rechkemmer wrote: > On Tue, Jun 07, 2005 at 01:50:30PM +0300, Giorgos Keramidas wrote: > > > > We'd have to see the entire ruleset and a tcpdump of traffic that passes > > through to know what's wrong. > > > > - Giorgos > > Here are the rules as taken from pfctl -sr. I can also provide a copy of > pf.conf, if needed. The user's host is in the "badhosts" table. I've changed > the first three octets of my IPs, for privacy reasons. The intruder's IP in > the tcpdump has also been masked. > > ***sorry about the word wrap*** > > scrub in all fragment reassemble > block drop on fxp0 from to any > block drop all > pass out quick on lo0 all > pass in quick on lo0 all > pass out on fxp0 inet proto icmp all icmp-type echoreq code 0 keep state > pass in on fxp0 inet proto icmp all icmp-type echoreq code 0 keep state Rule matching in PF (as in IP Filter) is "last match wins". The ICMP packets from entries match the following rules: scrub in all fragment reassemble block drop on fxp0 from to any pass in on fxp0 inet proto icmp all icmp-type echoreq code 0 keep state and the last rule wins... If you add "quick" to the `block from ' rule, packets from these hosts will immediately be dropped -- which is what you probably want to do, if I have understood what you wrote so far. - Giorgos