On 7/2/10 5:25 PM, Len Conrad wrote:
setting up pf on fbsd 7.2 for host security on a mail gateway.
the only rule for port 25 is:
pass in quick on em0 inet proto tcp from any to $ext_if port = smtp flags S/SA
keep state
and then last rule:
block drop in log on em0 inet from any to $ext_if
while 1000s of connections to port 25 are getting through with the pass rule,
several 100 connections are getting blocked with the default block rule,
bypassing the pass rule.
I can't see how pf is selecting these connections to be blocked.
In what sense are the packets that are getting blocked part of a
connection? Are you sure the blocked packets are actually a legitimate
first packet, with the appropriate flags set, or is the "flags S/SA"
portion of your rule not matching?
--
--Jon Radel
j...@radel.com