Hey Richard, Right you are, but I found the "NOT" statement I needed it's the "!" as in I can write the rule thusly:
# Block any other packets that are not heading to my IP block in log quick on pppoe0 from any to !65.196.xxx.yyy/32 head 11 #Unless they are destined for my NAT'd subnet pass in on pppoe0 from any to 192.168.1.0/24 group 11 Now I have a compact rule I put in line early to clean of the clutter before the rest of the filter list will have to process. My overall strategy is to start with as many quick blocks before packets run through the much larger rule sets. To me a rule like this seems useful for anyone using their box as a firewall/router/NAT to a private subnet... Opinions? Look for another topic seeking comments on my ipf rules list. Thanks, gene >From [EMAIL PROTECTED] Sat Nov 13 11:36:31 2004 >On Fri, November 12, 2004 23:17, Gene ENonymous said: >>>pass in quick on pppoe0 from any to 65.196.xxx.yyy/32 >>>block in quick on pppoe0 from any to any >> >> This is not quite what I thought I needed(see below). The pass in quick >> is immediate, it precludes further refinement and selection. >Ok, so you want something like this: >block in on pppoe0 from any to 65.196.xxx.yyy/32 head 10 >block in on pppoe0 from any to any >block in quick proto tcp port = 25 group 10 >block in quick proto tcp port = 80 group 10 >block in quick from badpeople/32 group 10 >etc >permit in quick all group 10 >Using groups is the way to go here.
