Re: pf tag/tagging and packages from localhost

2008-02-25 Thread scott
quot; is its running userID, to its queue. /S -Original Message- From: Stefan Schulze Frielinghaus <[EMAIL PROTECTED]> To: scott <[EMAIL PROTECTED]> Cc: misc@openbsd.org Subject: Re: pf tag/tagging and packages from localhost Date: Mon, 25 Feb 2008 12:31:31 +0100 Mailer

Re: pf tag/tagging and packages from localhost

2008-02-25 Thread Stefan Schulze Frielinghaus
ate > ... > pass out ... tagged MYTAG > # > > You may be able to further refine the any/any criteria. > > -----Original Message----- > From: Stefan Schulze Frielinghaus <[EMAIL PROTECTED]> > To: misc@openbsd.org > Subject: pf tag/tagging and packages from localh

Re: pf tag/tagging and packages from localhost

2008-02-25 Thread Darren Spiteri
On 2/25/08, Paul de Weerd <[EMAIL PROTECTED]> wrote: > On Mon, Feb 25, 2008 at 03:25:24PM +1100, Darren Spiteri wrote: > | That's an interesting and subtle use of PF tags, pity it's not in the PF > doco. > > > PF is not limited by what's in the documentation. It's just a tool and > it's limited

Re: pf tag/tagging and packages from localhost

2008-02-25 Thread Paul de Weerd
On Mon, Feb 25, 2008 at 03:25:24PM +1100, Darren Spiteri wrote: | That's an interesting and subtle use of PF tags, pity it's not in the PF doco. PF is not limited by what's in the documentation. It's just a tool and it's limited by your creative use of it. You can not expect all possible uses of t

Re: pf tag/tagging and packages from localhost

2008-02-24 Thread Darren Spiteri
That's an interesting and subtle use of PF tags, pity it's not in the PF doco. On 2/25/08, Claer <[EMAIL PROTECTED]> wrote: > For example, I use tags for QoS inside IPSEC. It's documented in > ipsec.conf(5)

Re: pf tag/tagging and packages from localhost

2008-02-24 Thread Claer
On Mon, Feb 25 2008 at 06:11, Darren Spiteri wrote: > On 2/25/08, Henning Brauer <[EMAIL PROTECTED]> wrote: > > * Darren Spiteri <[EMAIL PROTECTED]> [2008-02-24 15:11]: > > > > > Tags are for assigning trust between interfaces, for instance to > > > prevent traffic from WWW DMZ from leaking into t

Re: pf tag/tagging and packages from localhost

2008-02-24 Thread Darren Spiteri
On 2/25/08, Henning Brauer <[EMAIL PROTECTED]> wrote: > * Darren Spiteri <[EMAIL PROTECTED]> [2008-02-24 15:11]: > > > Tags are for assigning trust between interfaces, for instance to > > prevent traffic from WWW DMZ from leaking into the trusted LAN. > > > that is ONE use of them, but certaily no

Re: pf tag/tagging and packages from localhost

2008-02-24 Thread scott
be able to further refine the any/any criteria. -Original Message- From: Stefan Schulze Frielinghaus <[EMAIL PROTECTED]> To: misc@openbsd.org Subject: pf tag/tagging and packages from localhost Date: Sat, 23 Feb 2008 19:59:54 +0100 Mailer: Evolution 2.12.3 (2.12.3-1.fc8) Delivered-T

Re: pf tag/tagging and packages from localhost

2008-02-24 Thread Henning Brauer
* Darren Spiteri <[EMAIL PROTECTED]> [2008-02-24 15:11]: > Tags are for assigning trust between interfaces, for instance to > prevent traffic from WWW DMZ from leaking into the trusted LAN. that is ONE use of them, but certaily not the only one. -- Henning Brauer, [EMAIL PROTECTED], [EMAIL PROTE

Re: pf tag/tagging and packages from localhost

2008-02-24 Thread Darren Spiteri
Tags are for assigning trust between interfaces, for instance to prevent traffic from WWW DMZ from leaking into the trusted LAN. As the FW traffic is explicitly from the FW out a specified interface, as shown by your rule, then it doesn't need to have trust assigned to it as only one interface is i

pf tag/tagging and packages from localhost

2008-02-23 Thread Stefan Schulze Frielinghaus
Hello, I'm running OpenBSD 4.2-stable on a firewall with four interfaces. The settings are relative strict and default everything is blocked (block log all). While beside the packet filter also spamd is running the localhost needs to update the blacklists via spamd-setup. A rule like this allows t