>Gene ENonymous wrote: >> Is there anyway to block all trafic in on pppoe0 that is not to *my* single >> IP? >> >> something like: >> block in quick on pppoe0 from any to %NOT% 65.196.xxx.yyy/32 ?????
Richard Wrote Back: >That would be: >pass in quick on pppoe0 from any to 65.196.xxx.yyy/32 >block in quick on pppoe0 from any to any This is not quite what I thought I needed(see below). The pass in quick is immediate, it precludes further refinement and selection. My overall desired sequence is: 1) Block all bound inbound packets I know are not mine 2) block packet types I know I don't want at all. (short or controls) 3) Check and reject packets that come from "known" bad address ranges. 4) Then pass them in. Rule 3 is relatively large and I don't want to waste time with matching addresses when I can tell relatively fast that these packets are not bound for me at all. First I tried setting up a series of block rules (about 16) that stopped everything except those packets bound for my IP...this did NOT work. I endeded up determining a 25 rule CIDR block that stops everything except traffic bound for my address AND my NAT'd subnet range. I was shocked to see ipf blocking packets destined for my NAT'd subnet. The how-to says NAT works first - I just hadn't grasped the implications to incoming traffic. So now I'll assume I'm doing this about as efficiently as I can? It still seems it'd be useful if I could write a rule like: block in quick on pppoe0 from any to %NOT% 65.196.xxx.yyy/32 or %NOT% 192.168.1.0/24? Thanks for the reply Richard! --gene
