black_whole vs black_hole check the table name ...
On Wed, 5 May 2021 at 12:11, Axel Rau <axel....@chaos1.de> wrote: > > Hi all, > > in pf.conf, I have at the beginning: > - - - > table <black_hole> persist file "/etc/pf/black_hole.txt" > block drop in quick on $red_if from <black_whole> flags any > > fw1# pfctl -s rules | head -3 > block drop in quick on em2 from <black_whole> to any > > fw1# pfctl -t black_hole -T show > . . . > 146.168.0.0/16 > . . . > > But responses still going out from my ns: > > 0800 532: x.y.z.71.53 > 146.168.163.94.443: [udp sum ok] 1- 0/13/14(490) > (ttl 63, id 10399, len 518) > 0800 72: 146.168.163.94.443 > x.y.z.21.53: [no udp cksum] 1+ RRSIG? > pizzaseo.com.(30) (ttl 249, id 3922, len 58) > 0800 532: x.y.z.21.53 > 146.168.163.94.443: [udp sum ok] 1- 0/13/14(490) > (ttl 63, id 38336, len 518) > 0800 72: 146.168.163.94.443 > x.y.z.171.53: [no udp cksum] 1+ RRSIG? > pizzaseo.com.(30) (ttl 249, id 55913, len 58) > 0800 532: x.y.z.171.53 > 146.168.163.94.443: [udp sum ok] 1- 0/13/14(490) > (ttl 62, id 53578, len 518) > > > What is wrong in my setup? > > Thanks, Axel > --- > PGP-Key: CDE74120 computing @ chaos claudius > -- Kindest regards, Tom Smyth.
