confusion with the pf filter rule syntax
From: Sameer (ssnewsgroups_at_hotmail.com)
Date: 11/24/03
- Next message: Daniel Hartmeier: "Re: confusion with the pf filter rule syntax"
- Previous message: erik: "Re: named permission"
- Next in thread: Daniel Hartmeier: "Re: confusion with the pf filter rule syntax"
- Reply: Daniel Hartmeier: "Re: confusion with the pf filter rule syntax"
- Reply: Greg Hennessy: "Re: confusion with the pf filter rule syntax"
- Reply: Marco S Hyman: "Re: confusion with the pf filter rule syntax"
- Reply: Test: "Re: confusion with the pf filter rule syntax"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: Mon, 24 Nov 2003 06:24:05 GMT
this is what the FAQ says:
action direction [log] [quick] on int [af] [proto protocol] from src_addr
[port src_port] to dst_addr [port dst_port] [tcp_flags] [state]
i'm a bit confused here. personally, i'm having issue with this "on int"
and "from src_addr". to me this seems to be a redundancy, and, not matter
how i tried to read it, i really can't see otherwise.
why do you need to state an interface as well as a source address? won't it
suffice to simply state a source and a destination, thereby circumventing
the "on int" portion?
for example, say you are looking to allow packets outside a device with the
following parameters:
outside interface, hme0 - 172.16.0.1
inside interface, hme1 - 192.168.1.1
can't you say,
pass out from 192.168.1.1 proto tcp to any modulate state
or
pass out on hme1 proto tcp to 182.16.0.1 modulate state
maybe i'm not understanding something that someone might see... so any
explanation would be helpful.
i know some will say "go away and don't bother us until you test it
yourself" ... however, i really would like to understand the syntax properly
instead of being hit and miss with trial and error. the understanding is
more important to me than getting it to work.
- Next message: Daniel Hartmeier: "Re: confusion with the pf filter rule syntax"
- Previous message: erik: "Re: named permission"
- Next in thread: Daniel Hartmeier: "Re: confusion with the pf filter rule syntax"
- Reply: Daniel Hartmeier: "Re: confusion with the pf filter rule syntax"
- Reply: Greg Hennessy: "Re: confusion with the pf filter rule syntax"
- Reply: Marco S Hyman: "Re: confusion with the pf filter rule syntax"
- Reply: Test: "Re: confusion with the pf filter rule syntax"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]