I currently allow SSH to a specific machine on rule #7. Before I had the rule in place, the log would report dropped packets on rule 0:5, even though rule #5 had absolutely nothing to do with SSH or dropping packets (as verified in ipf.conf), it was a "pass in" rule! And I'm using "quick" on all my rules, since my ruleset is designed around the "match" premise. Then I modified rule #7, and now SSH to the host works, however, now it shows it's being passed on rule #5!
I use isba to build and control the ruleset; but I am well aware that what is one rule in isba may get compiled to multiple rules in ipf.conf. With that in mind, I stepped through each and every rule that was compiled and came with the conclusion above. Anyone have any ideas on what's up with this trip???
