On 2/20/07, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: > > Greetings, > > Does it make any difference if I group my rules like this ..... > ## logs smtp sessions > pass in log on $ext_if proto tcp to $mailhost port smtp keep state > ## Pass all outgoing traffics > pass out on $ext_if inet proto tcp all flags S/SA keep state > pass out log on $ext_if inet proto tcp from $mailhost to any port smtp > keep state > pass out on $ext_if inet proto { icmp, udp } all keep state > > Or, like this ......... > ## logs smtp sessions > pass in log on $ext_if proto tcp to $mailhost port smtp keep state > pass out log on $ext_if inet proto tcp from $mailhost to any port smtp > keep state > ## Pass all outgoing traffics > pass out on $ext_if inet proto tcp all flags S/SA keep state > pass out on $ext_if inet proto { icmp, udp } all keep state
Last matching rule wins so the second example won't do what you're expecting. http://www.openbsd.org/faq/pf/filter.html Also, try to use "flags S/SA" on all of your stateful TCP rules unless you have a good reason not to. -- Kian Mohageri