The antispoof directive will expand to two block rules with IP address
of the interface, so I would think that with a dynamic IP, the interface
should be surrounded in parentheses like this:

antispoof for (wi0)

But this seems to be wrong, as I have not read any guide or FAQ that
does this, e.g. the "Building a router" guide found at

In the gateway configuration, egress group is surrounded with
parentheses in multiple places, but not with antispoof:

antispoof quick for { egress $wired $wifi }

Why should this not be

antispoof quick for { (egress) $wired $wifi }


antispoof quick for { (egress:0) $wired $wifi }

Another thing I was wondering about while reading the manpage for

The simplest mechanism to block everything by default and only pass
packets that match explicit rules is specify a first filter rule of:

    block all

Is it not even simpler to just specify the filter rule as block without
all, they seem to expand identical?


Mogens Jensen

Reply via email to