Vedran Bender wrote:
The answer is, IPF does not behave like FW-1 or FW NG by default. The way you have it configured right now, the parsing goes through all the rules. If you had a rule that said "ANY ANY ANY drop" and then a rule that said "ANY ANY ANY accept", all packets would flow, because that was the last rule that pertained to the condition.In order for your ruleset to work as designed, you need to add the "quick" keyword, which then stops parsing once a packet matches the rule.
Nah, his pass rules are last, so this won't matter.
I address this briefly in the FAQ. It's nice because you have a choice... either works, and you can design it with or with the quick. In other firewalls you are not given that choice.And a question for Mr. Reed, why does IPFilter behave in this way by default, rather than behaving like FW-1 and most other firewalls do?
--
Phil Dibowitz [EMAIL PROTECTED]
Freeware and Technical Pages Insanity Palace of Metallica
http://home.earthlink.net/~jaymzh666/ http://www.ipom.com/
"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
- Benjamin Franklin, 1759
