From owner-freebsd-pf@freebsd.org  Mon Jun 29 08:33:57 2015
Return-Path: <owner-freebsd-pf@freebsd.org>
Delivered-To: freebsd-pf@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 6DAC298D077
 for <freebsd-pf@mailman.ysv.freebsd.org>; Mon, 29 Jun 2015 08:33:57 +0000 (UTC)
 (envelope-from dave@horsfall.org)
Received: from teparybean2.exetel.com.au (teparybean2.exetel.com.au
 [220.233.0.94]) by mx1.freebsd.org (Postfix) with ESMTP id 2E6362D52
 for <freebsd-pf@freebsd.org>; Mon, 29 Jun 2015 08:33:56 +0000 (UTC)
 (envelope-from dave@horsfall.org)
Received: from phasia.kd.net.au ([220.233.10.47])
 by teparybean2.exetel.com.au with esmtp (Exim 4.84)
 (envelope-from <dave@horsfall.org>) id 1Z9UGq-0005KH-JA
 for freebsd-pf@freebsd.org; Mon, 29 Jun 2015 18:18:28 +1000
Received: from aneurin.horsfall.org (unknown [120.146.8.15])
 by dermis.kd (Postfix) with ESMTP id 32279CDA8
 for <freebsd-pf@freebsd.org>; Mon, 29 Jun 2015 18:18:28 +1000 (EST)
Received: from aneurin.horsfall.org (localhost [127.0.0.1])
 by aneurin.horsfall.org (8.14.9/8.14.9) with ESMTP id t5T8IQ5l002422
 for <freebsd-pf@freebsd.org>; Mon, 29 Jun 2015 18:18:27 +1000 (EST)
 (envelope-from dave@horsfall.org)
Received: from localhost (dave@localhost)
 by aneurin.horsfall.org (8.14.9/8.14.9/Submit) with ESMTP id t5T8IQwC002419
 for <freebsd-pf@freebsd.org>; Mon, 29 Jun 2015 18:18:26 +1000 (EST)
 (envelope-from dave@horsfall.org)
X-Authentication-Warning: aneurin.horsfall.org: dave owned process doing -bs
Date: Mon, 29 Jun 2015 18:18:26 +1000 (EST)
From: Dave Horsfall <dave@horsfall.org>
To: FreeBSD PF List <freebsd-pf@freebsd.org>
Subject: Re: Large scale NAT with PF - some weird problem
In-Reply-To: <20150629094317.5a0cd61a@zeta.dino.sk>
Message-ID: <alpine.BSF.2.11.1506291816200.96902@aneurin.horsfall.org>
References: <20150620182432.62797ec5@zeta.dino.sk>
 <20150619091857.304b707b@zeta.dino.sk>
 <14e119e8fa8.2755.abfb21602af57f30a7457738c46ad3ae@capeaugusta.com>
 <E1Z6dHz-0000uu-D8@clue.co.za> <E1Z6eVg-0000yz-Ar@clue.co.za>
 <20150621195753.7b162633@zeta.dino.sk>
 <E1Z7Ixx-0006K1-5p@clue.co.za> <E1Z7K1Y-0006Ph-ON@clue.co.za>
 <20150623112331.668395d1@zeta.dino.sk> <20150628100609.635544e0@zeta.dino.sk>
 <20150629065838.GA13722@insomnia.benzedrine.ch>
 <20150629094317.5a0cd61a@zeta.dino.sk>
User-Agent: Alpine 2.11 (BSF 23 2013-08-11)
X-Witty-Saying: "chmod 666 the_mode_of_the_beast"
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
 \(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf/>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 29 Jun 2015 08:33:57 -0000

On Mon, 29 Jun 2015, Milan Obuch wrote:

> Thanks for hint, there is some logic in there, however
> 
> grep <apparently.offending.ip.address> /etc/*
> 
> yields nothing, it is never mentioned in any config, just as part of
> pool in pf.conf statement

What about "grep -r"?  My ACLs are under /etc/mail, for example.

-- 
Dave Horsfall  (VK2KFU)  "Those who don't understand security will suffer"
http://www.horsfall.org/  It's just a silly little web site, that's all...