is there a way to tag the packets going to pflog, i can see the packets being blocked with tcpdump on /var/log/pflog, but i would like to know what rule is blocking them
i changed my rules a little bit here is the output of pfctl -s rules, i was hoping that explictly defining some of these would help but same result block return in log on xl0 all block drop in log on xl1 all pass in on xl0 inet from any to 192.168.25.253 keep state pass in on xl1 inet from 192.168.25.253 to any keep state pass out on xl0 all pass out on xl1 all pass in on xl0 inet from any to 192.168.25.33 pass in on xl1 inet from 192.168.25.33 to any pass in on xl0 inet from any to 192.168.25.69 pass in on xl1 inet from 192.168.25.69 to any pass in on xl0 inet from any to 192.168.25.84 pass in on xl1 inet from 192.168.25.64 to any pass in on xl0 inet from any to 192.168.25.100 pass in on xl1 inet from 192.168.25.100 to any pass in on xl0 inet from any to 192.168.25.201 pass in on xl1 inet from 192.168.25.201 to any pass in on xl0 inet from any to 192.168.25.252 pass in on xl1 inet from 192.168.25.252 to any On 20/03/07, Stuart Henderson <[EMAIL PROTECTED]> wrote:
On 2007/03/20 06:18, Lawrence Horvath wrote: > On 20/03/07, Stuart Henderson <[EMAIL PROTECTED]> wrote: > >On 2007/03/20 04:41, Lawrence Horvath wrote: > >> I have the below rule set in my pf.conf, i am having the following > >> problem, i need to be able to log into the firewall with ssh from > >> outside, and nothing should be able to hit the firewall from inside, > >> not even ping > > > >You don't "pass out" anything, either directly or via keep state. > >Also see the Notes section of bridge(4). ahh, I missed that you have a default "pass out" since your default blocks are only for inbound. tcpdump on various interfaces (including pflog0 with the relevant log keywords adding to pf.conf) will help you see how it works. Some things depend on which interface has the IP address. The advice in bridge(4) about passing/skipping traffic on one of the interfaces makes things easier to follow.
-- -Lawrence -Student ID 1028219 -CCNA
