On Tue, Dec 17, 2013 at 7:51 PM, Jan Stary <[email protected]> wrote:
>> block in log
>> block out log on $ext
>
> How could anyone help you knowing just these two lines?
> Show your pf.conf
I was trying to show that I only had two block lines and that they
both should log when blocking packets. My rules are actually very
simple:
match out on $ext from $int_ip to any nat-to $loki_ext
block in log
block out log on $ext
pass in quick on $int flags any
pass out on $ext from $lokisafe
pass in on $ext inet proto tcp to port 4334 rdr-to 127.0.0.1 port ssh
pass in on $ext inet proto tcp from $mx to $loki_ext port smtp
rdr-to $riva port smtp flags any
pass out on $int inet proto tcp from $mx port smtp flags any
$int and $ext are interfaces on the firewall (loki). $loki_ext is the
external IP, $int_ip is the internal /24. $lokisafe is a selection of
/24s that I've sometimes used, including the internal network. $riva
is my home mail server. $mx is the IP addresses of my hosted MX
servers.
With tcpdump, I can see the response to the EHLO greeting leaving
riva, arriving on $int, but never making it to $ext. Using HELO
instead doesn't prompt the same behaviour.
Tet
--
"Java is a DSL for taking large XML files and converting them to stack
traces" -- Bulat Shakirzyanov
