On Mon, Jan 05, 2004 at 05:37:21PM -0500, Ray wrote: > > block log all > > pass on $int > > pass out on $ext from ($ext) to any keep state > > Wouldn't this pass all packets, rendering the ``block log all'' > useless?
It wouldn't pass connections coming in on $ext (either going to the firewall itself or out through $int). A connection coming in on $ext first has to pass $ext, where only the first rule matches (the second one doesn't match because the interface is $ext, not $int, and the third mismatches because the direction of the packet is in, not out). Hence, incoming connections through $ext are blocked by the first rule. Daniel
