On Fri, Jun 10, 2005 at 09:33:50PM +0300, Giorgos Keramidas wrote: > > Existing icmp states? > > Did you reload the rules with: > > /etc/rc.d/pf reload > > or by directly running pfctl?
I tried flushing everything with pfctl -Fa, and then loading the rules with pfctl -f /etc/pf.conf. The script in rc.d seems to do the same thing. After re-loading the rules, pfctl -sr yields: [EMAIL PROTECTED] pfctl -sr | head -n2 scrub in all fragment reassemble block drop quick on fxp0 from <badhosts> to any I've verified the table has actual IP addresses. It seems to be able to block new TCP connections. However, if an IP is connected currently, pf lets that connection continue; even after flushing the states and sources. It doesn't seem to care about ICMP. I can ping it from the box running pf, and receive replies. Am I just missing something obvious here? -- Matt Rechkemmer [EMAIL PROTECTED] _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
