Re: Blocking "shodan.io" - What are my options?

[tomr]

On 1/9/19 12:42 PM, Jordan Geoghegan wrote:
> 
> Yikes. Everything you are (erroneously) trying to do here can be done
> without leaving your pf.conf.
> 
> Remember, KISS.
> 

Is there a way to add an address to a table from within a rule, or
something to that effect? I can't see such an option. A la...

block in quick on $ext_if to any port ! { $allowed_ports } add-to <badguys>


(Otherwise I don't see how the whole show could be completed without
logging, monitoring the log, then running pfctl, ie with leaving your
pf.conf)