Date: Thu, 23 Sep 2004 17:16:14 +1000 (EST) From: David Atkinson <david@atkinsonet.com> To: Bikrant Neupane <bikrant_ml@wlink.com.np> Subject: Re: Ipfw accept rule Message-ID: <20040923165730.E67579@mailgate.alburybf.org> Resent-Message-ID: <20040923171730.L67579@mailgate.alburybf.org> In-Reply-To: <200409231233.00370.bikrant_ml@wlink.com.np> References: <200409231233.00370.bikrant_ml@wlink.com.np>
next in thread | previous in thread | raw e-mail | index | archive | help
Are you looking for something like count? The whole idea of an allow rule is that once it matches it is assumed that you actually do want that packet and there is no point continuing through the ruleset. If you want to have a general allow rule with a few specific exclusions, add one or two deny rules for the specific cases and then have your more general allow rule. One problem that does occur with this plan is that it becomes very easy to overload your server with lots of rarely matched deny rules. If you find the time in interupt going too high look at constructing some blocks of rules and setup some skipto rules. In the case of blocking (firewalling off) well known sources of spam, a lot of rules can be generated very quickly. As these only apply to port 25 traffic, as skipto can be used to skip these rules for all other traffic. 1000 skipto 2000 tcp from any to any 25 1100 skipto 4000 ip from any to any 2000 deny ip from spammer.com to any ... HTH, David Atkinson On Thu, 23 Sep 2004, Bikrant Neupane wrote: > Hi, > When a packet hits "allow | accept | pass | permit" rule the packet is > accepted and the search is retiminated at that point. > > I need to accept the packet but still want the packet to continue travers > rules further below. However, once it hits "deny | drop" rule it should be > dropped and the search should terminate at that point. Is that possible with > IPFW? > > regards, > Bikrant > > > _______________________________________________ > freebsd-isp@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-isp > To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org" >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040923165730.E67579>