From owner-freebsd-questions@FreeBSD.ORG Fri Jun 10 18:33:57 2005 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6C07116A41C for ; Fri, 10 Jun 2005 18:33:57 +0000 (GMT) (envelope-from keramida@ceid.upatras.gr) Received: from aiolos.otenet.gr (aiolos.otenet.gr [195.170.0.93]) by mx1.FreeBSD.org (Postfix) with ESMTP id B0FFA43D49 for ; Fri, 10 Jun 2005 18:33:55 +0000 (GMT) (envelope-from keramida@ceid.upatras.gr) Received: from orion.daedalusnetworks.priv (aris.bedc.ondsl.gr [62.103.39.226]) by aiolos.otenet.gr (8.13.4/8.13.4/Debian-1) with SMTP id j5AIXoiw004281; Fri, 10 Jun 2005 21:33:51 +0300 Received: from orion.daedalusnetworks.priv (orion [127.0.0.1]) by orion.daedalusnetworks.priv (8.13.4/8.13.4) with ESMTP id j5AIXoeh021895; Fri, 10 Jun 2005 21:33:50 +0300 (EEST) (envelope-from keramida@ceid.upatras.gr) Received: (from keramida@localhost) by orion.daedalusnetworks.priv (8.13.4/8.13.4/Submit) id j5AIXoSi021894; Fri, 10 Jun 2005 21:33:50 +0300 (EEST) (envelope-from keramida@ceid.upatras.gr) Date: Fri, 10 Jun 2005 21:33:50 +0300 From: Giorgos Keramidas To: Matt Rechkemmer Message-ID: <20050610183349.GA21866@orion.daedalusnetworks.priv> References: <20050607064323.GA29038@sdf.lonestar.org> <20050607105030.GA44218@orion.daedalusnetworks.priv> <20050609101805.GA11341@sdf.lonestar.org> <20050609105116.GA87877@orion.daedalusnetworks.priv> <20050609204814.GA11510@sdf.lonestar.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20050609204814.GA11510@sdf.lonestar.org> Cc: freebsd-questions@freebsd.org Subject: Re: pf block question X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Jun 2005 18:33:57 -0000 On 2005-06-09 13:48, Matt Rechkemmer wrote: > On Thu, Jun 09, 2005 at 01:51:16PM +0300, Giorgos Keramidas wrote: > > > > If you add "quick" to the `block from ' rule, packets from > > these hosts will immediately be dropped -- which is what you probably > > want to do, if I have understood what you wrote so far. > > OK, I've added quick to the rule (surprised I forgot it there). Here's the > new rule: block drop quick on fxp0 from to any. Now, when I send > ICMP packets to that host (for testing), I *still* get them back but with an > extreme amount of loss. If I comment the rule, the loss disappears. > > I'm at a loss as to why the traffic still isn't dropped. Existing icmp states? Did you reload the rules with: /etc/rc.d/pf reload or by directly running pfctl?