Re: ipf rules question

2009-07-28 Thread Erik Norgaard
Erik Norgaard wrote: Jay Hall wrote: And, following is the output from ipfstat showing the relevant rule(s). @140 block in quick proto tcp from 82.0.0.0/8 to any port = smtp Evidently, things get passed by some other rule, you can get a clue by adding the log action to all rules passing packe

Re: ipf rules question

2009-07-28 Thread Erik Norgaard
Jay Hall wrote: And, following is the output from ipfstat showing the relevant rule(s). @140 block in quick proto tcp from 82.0.0.0/8 to any port = smtp If I am looking at everything correctly all traffic coming into the system from the 82.0.0.0/8 network to port 25 on the mail server shoul

Re: ipf rules question

2009-07-27 Thread Jay Hall
On Jul 27, 2009, at 4:40 PM, Chuck Swiger wrote: On Jul 27, 2009, at 2:27 PM, Jay Hall wrote: [ ... ] If I am looking at everything correctly all traffic coming into the system from the 82.0.0.0/8 network to port 25 on the mail server should be blocked. What am I missing? Otherwise, may

Re: ipf rules question

2009-07-27 Thread Chuck Swiger
On Jul 27, 2009, at 2:27 PM, Jay Hall wrote: [ ... ] If I am looking at everything correctly all traffic coming into the system from the 82.0.0.0/8 network to port 25 on the mail server should be blocked. What am I missing? Maybe they are connecting to the MSP aka 587/tcp rather than port

ipf rules question

2009-07-27 Thread Jay Hall
Ladies and Gentlemen, I think I am missing something. I am running a FreeBSD 6. server with ipf compiled into the kernel. Following are the headers from an email. From: oea...@brantbenun.com Subject: SUSPECTED SPAM REAL Doctors, REAL Science, REAL Results! Date: Ju