Re: Rule ordering changes

2013-03-11 Thread Stuart Henderson
On 2013/03/11 12:06, Andrew Siegel wrote: > I've been scratching my head over this one. Here is my pf.conf: > > int_if = "em0" > dmz_if = "em1" > block log all > set skip on lo0 > block log quick inet6 > block in log quick on $int_if from ! to any > block out log quick on $int_if from any to !

Re: Rule ordering changes

2013-03-11 Thread Andrew Siegel
On 3/11/13 3:45 PM, Stuart Henderson wrote: On 2013/03/11 12:06, Andrew Siegel wrote: .. I've been scratching my head over this one. Here is my pf.conf: This is under OpenBSD 5.1. Am I misunderstanding something? Is some kind of optimization taking place behind the scenes? Andy Thank

Rule ordering changes

2013-03-11 Thread Andrew Siegel
I've been scratching my head over this one. Here is my pf.conf: int_if = "em0" dmz_if = "em1" block log all set skip on lo0 block log quick inet6 block in log quick on $int_if from ! to any block out log quick on $int_if from any to ! pass out log on $int_if inet proto tcp from $int_if:0 to