From owner-freebsd-pf@FreeBSD.ORG Sun Feb 14 00:30:59 2010 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id B21FD106568F for ; Sun, 14 Feb 2010 00:30:59 +0000 (UTC) (envelope-from ddesimone@verio.net) Received: from relay2-bcrtfl2.verio.net (relay2-bcrtfl2.verio.net [131.103.218.177]) by mx1.freebsd.org (Postfix) with ESMTP id 662B48FC12 for ; Sun, 14 Feb 2010 00:30:59 +0000 (UTC) Received: from iad-wprd-xchw01.corp.verio.net (unknown [198.87.7.164]) by relay2-bcrtfl2.verio.net (Postfix) with ESMTP id 6E3C71FF0AF4 for ; Sat, 13 Feb 2010 19:30:58 -0500 (EST) thread-index: AcqtDPoGGhO/W4rKQFmdz4TXUg0zfQ== Received: from dllstx1-8sst9f1.corp.verio.net ([10.144.0.33]) by iad-wprd-xchw01.corp.verio.net over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959); Sat, 13 Feb 2010 19:30:56 -0500 Received: by dllstx1-8sst9f1.corp.verio.net (sSMTP sendmail emulation); Sat, 13 Feb 2010 18:30:56 +0000 Content-Transfer-Encoding: 7bit Date: Sat, 13 Feb 2010 18:30:55 -0600 From: "David DeSimone" Content-Class: urn:content-classes:message Importance: normal Priority: normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4325 To: Message-ID: <20100214003055.GE952@verio.net> Mail-Followup-To: freebsd-pf@freebsd.org References: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline In-Reply-To: Precedence: bulk User-Agent: Mutt/1.5.18 (2008-05-17) X-OriginalArrivalTime: 14 Feb 2010 00:30:56.0866 (UTC) FILETIME=[F9624420:01CAAD0C] Subject: Re: pf: nat works, ip blocking and logging do not X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Feb 2010 00:30:59 -0000 Alex Teslik wrote: > > Unfortunately, I can still go to 11.11.11.111 or 22.22.22.222 with no > blocking and no logging on /var/log/pflog. Your outbound traffic first matches this rule: > pass out all [keep state] The [keep state] I added because it is implied; you would have to explicitly add "no state" in order to avoid it, and you probably actually do want state-tracking on most outbound connections. This is important to your question, though, because if you open an outbound connection to 11.11.11.111 or 22.22.22.222, it will store a state entry, and state entries are checked BEFORE any rule-checking, for reply traffic coming back from those hosts. So, these rules: > block drop in log (all) quick on $ext_if from { 11.11.11.111, 22.22.22.222 } to any > block drop out log (all) quick on $ext_if from { 11.11.11.111, 22.22.22.222 } to any will never be checked, because they match the previously built state. In order to prevent communications with these hosts, you must also add "block out [quick]" rules which prevent you from initiating the connection to them and thus building state entries. -- David DeSimone == Network Admin == fox@verio.net "I don't like spinach, and I'm glad I don't, because if I liked it I'd eat it, and I just hate it." -- Clarence Darrow This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio, Inc. makes no warranty that this email is error or virus free. Thank you.