On Fri, Jan 09, 2004 at 09:41:45AM -0000, Peter Galbavy wrote:
> Alexey E. Suslikov wrote:
> > b) uncomfortableness for people, who wants to have bunch
> > of rules "stated" differently from their "state policy"
> > default, instead of just constructing more hacking-proofing
> > ruleset.
>
> If I understand correctly, Alexey is asking for a global option for the
> default behaviour. This would be neat.
You mean like this? man pf.conf:
...
set state-policy
The state-policy option sets the default behaviour for states:
if-bound States are bound to interface.
group-bound States are bound to interface group (i.e. ppp)
floating States can match packets on any interfaces (the de-
fault).
For example:
set state-policy if-bound
...
