Erik Norgaard wrote:

I want to create two tables in my packet filter, the first should match any valid public ip, so I created a table negating anything reserved:

table <internet> const { !0/8 !10/8 !127/8 !169.254/16 !172.16/12 \
                    !192.0.2/24 !192.168/16 !198.18/15 !224/4 !240/4 }

Of course, I could do something different here, defining a table for <local> networks and negate it. The rest should be caught by the filtering rules anyway to block non-routable packets.

I have three tables with different registered hosts with different access levels, I want to redirect unknown hosts to a page explaining what to do to get registered,

rdr on $wlan_if proto tcp from { $wlan_net !<super> !<users> !<free> } \
     to <internet> port http -> 127.0.0.1 port 8000

This one is solved with:

no rdr on $wlan_if proto tcp from { <super> <users> <free> } \
      to <internet> port http
rdr on $wlan_if proto tcp from $wlan_net to !<local> \
      port http -> 127.0.0.1 port 8000

However, it would be nice to know if the documentation is incorrect, or there is a difference in how negation is treated in nat and filter respectively.

Thanks, Erik
--
Ph: +34.666334818                      web: http://www.locolomo.org

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

Reply via email to