From owner-freebsd-questions@FreeBSD.ORG  Tue Jul 28 14:33:12 2009
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 3784E106566B
	for <freebsd-questions@freebsd.org>;
	Tue, 28 Jul 2009 14:33:12 +0000 (UTC)
	(envelope-from norgaard@locolomo.org)
Received: from mail.locolomo.org (97.pool85-48-194.static.orange.es
	[85.48.194.97]) by mx1.freebsd.org (Postfix) with ESMTP id E6DE78FC17
	for <freebsd-questions@freebsd.org>;
	Tue, 28 Jul 2009 14:33:11 +0000 (UTC)
	(envelope-from norgaard@locolomo.org)
Received: from beta.1-16-172-dyn.locolomo.org (beta.1-16-172-dyn.locolomo.org
	[172.16.1.127])
	by mail.locolomo.org (Postfix) with ESMTPSA id 17EC01C1A67;
	Tue, 28 Jul 2009 16:33:10 +0200 (CEST)
Message-ID: <4A6F0C25.7040400@locolomo.org>
Date: Tue, 28 Jul 2009 16:33:09 +0200
From: Erik Norgaard <norgaard@locolomo.org>
User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605)
MIME-Version: 1.0
To: Jay Hall <jhall@socket.net>
References: <0E15E941-3CC2-4C9B-BAF2-C8910F7592ED@socket.net>
In-Reply-To: <0E15E941-3CC2-4C9B-BAF2-C8910F7592ED@socket.net>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit
Cc: freebsd-questions@freebsd.org
Subject: Re: ipf rules question
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 28 Jul 2009 14:33:12 -0000

Jay Hall wrote:
> And, following is the output from ipfstat showing the relevant rule(s).
> 
> @140 block in quick proto tcp from 82.0.0.0/8 to any port = smtp
> 
> If I am looking at everything correctly all traffic coming into the  
> system from the 82.0.0.0/8 network to port 25 on the mail server  
> should be blocked.
> 
> What am I missing?

I can't tell you what you're missing, but we're missing the entire 
story. Just because you have a block rule doesn't mean that things will 
get blocked if you have a pass rule before. You need to post the entire 
ruleset if you want help with that.

Evidently, things get passed by some other rule, you can get a clue by 
adding the log action to all rules passing packets to port 25 or any port.

When adding new rules it is a good idea to add log statements so you can 
debug. Once things work, remove them to reduce the noise.

BR, Erik

-- 
Erik Nørgaard
Ph: +34.666334818/+34.915211157                  http://www.locolomo.org