From owner-freebsd-questions@FreeBSD.ORG  Thu Jun  9 20:49:49 2005
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
X-Original-To: freebsd-questions@freebsd.org
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 42D5416A41C
	for <freebsd-questions@freebsd.org>;
	Thu,  9 Jun 2005 20:49:49 +0000 (GMT)
	(envelope-from tiberius@sdf.lonestar.org)
Received: from sdf.lonestar.org (mx.freeshell.org [192.94.73.21])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 07B3943D49
	for <freebsd-questions@freebsd.org>;
	Thu,  9 Jun 2005 20:49:48 +0000 (GMT)
	(envelope-from tiberius@sdf.lonestar.org)
Received: from sdf.lonestar.org (IDENT:tiberius@sverige.freeshell.org
	[192.94.73.4])
	by sdf.lonestar.org (8.13.1/8.12.10) with ESMTP id j59KmkCu014467;
	Thu, 9 Jun 2005 20:48:46 GMT
Received: (from tiberius@localhost)
	by sdf.lonestar.org (8.13.1/8.12.8/Submit) id j59KmEw3019472;
	Thu, 9 Jun 2005 13:48:14 -0700 (MST)
Date: Thu, 9 Jun 2005 13:48:14 -0700
From: Matt Rechkemmer <tiberius@trancell.org>
To: Giorgos Keramidas <keramida@ceid.upatras.gr>
Message-ID: <20050609204814.GA11510@sdf.lonestar.org>
References: <20050607064323.GA29038@sdf.lonestar.org>
	<20050607105030.GA44218@orion.daedalusnetworks.priv>
	<20050609101805.GA11341@sdf.lonestar.org>
	<20050609105116.GA87877@orion.daedalusnetworks.priv>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20050609105116.GA87877@orion.daedalusnetworks.priv>
User-Agent: Mutt/1.4.2.1i
Cc: freebsd-questions@freebsd.org
Subject: Re: pf block question
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 09 Jun 2005 20:49:49 -0000

On Thu, Jun 09, 2005 at 01:51:16PM +0300, Giorgos Keramidas wrote:
> 
> If you add "quick" to the `block from <badhosts>' rule, packets from
> these hosts will immediately be dropped -- which is what you probably
> want to do, if I have understood what you wrote so far.
> 
> - Giorgos

OK, I've added quick to the rule (surprised I forgot it there).  Here's the
new rule: block drop quick on fxp0 from <badhosts> to any.  Now, when I send
ICMP packets to that host (for testing), I *still* get them back but with an
extreme amount of loss.  If I comment the rule, the loss disappears.

I'm at a loss as to why the traffic still isn't dropped.

--
Matt Rechkemmer
tiberius@trancell.org