On Wed, 31 Dec 2003, James Cammarata wrote: > # the local interface is wide open > pass in quick on lo0 all > pass out quick on lo0 all
You really want the lo0 rules before any block rules, just to be sure.
right, normally i'd agree but I doubt it makes a difference here. I've got the global blocks first, followed by very specific blocking on the two external interfaces (which should not affect a 127.0.0.1 address at all) and then the pass quick for the loopback. it wouldn't hurt to move the loopback stuff up first of course, but i'm sure that's not the problem.
> >What does 'tcpdump -i pflog0 -env' say when you start an FTP session? > > # tcpdump -env -i lo0 > tcpdump: listening on lo0
pflog0, not lo0.
I'm an idiot :|
I did answer this in the first email though, pflog0 was not showing any activity while the ftp program was trying to connect. The command "ftp ftp.openbsd.org" on my test server caused this on xl2:
192.168.10.11.52157 > 129.128.5.191.21: tcp 0 (DF)
(192.168.10.11 being the internal computer i ran that command on). Nothing appeared on lo0, pflog0, xl1, or xl0 after this packet came into xl2.
James Cammarata [EMAIL PROTECTED] www.sngx.net home: 314-835-1122 work: 314-872-2426 cell: 314-409-0583 ______________________________________________________________ Out the Ethernet, through the router, down the fiber, off another router, down the T1, past the fire-wall ...nothing but Net
