ahhhhhhh *lightbulb*
Thanks Daniel!
--Bryan
On Fri, 10 Sep 2004 01:27:13 +0200, Daniel Hartmeier
<[EMAIL PROTECTED]> wrote:
> On Thu, Sep 09, 2004 at 03:21:25PM -0700, Bryan Irvine wrote:
>
> > anyone know why this rule doesn't work?
>
> Because of the way {} lists are simply expanded by pfctl into multiple
> rules. If it were accepted,
>
> rdr from any to ! { a, b } -> c
>
> would become (be equivalent to)
>
> rdr from any to ! a -> c
> rdr from any to ! b -> c
>
> which would match any destination address, since any address is either
> different from a or different from b (assuming a != b), becoming
> equivalent to
>
> rdr from any to any -> c
>
> Hence, the construct is useless and refused by pfctl.
>
> Use a table
>
> table <exceptions> { a, b }
> rdr from any to ! <exceptions> -> c
>
> or a 'no rdr' construct
>
> no rdr from any to a
> no rdr from any to b
> rdr from any to any -> c
>
> Daniel
>
