PF firewall rules

[Travis H.]

On 7/11/06, Kian Mohageri <kian.mohageri at gmail.com> wrote:
> I'm not sure if I'm understanding you correctly, but if having the direction
> in the rule is confusing to you, you can leave it out:
>
> block quick on $int_If proto { tcp, udp, icmp } from 192.168.1.17 to any

Better yet, drop the "on $int_if", since if the 192.168/16 block is
allocated to LAN hosts, you probably don't want to allow it in on any
other interface, either.  And why enumerate TCP, UDP, ICMP?  Are you
trying to allow IGMP from this host?  What you don't know can hurt
you!  I say drop the protocol specification too.  This simplfies your
rule to:

block quick from 192.168.1.17 to any

See?  Using lists causes several rules to be created, so as well as
being simpler, this is more efficient too.
-- 
Resolve is what distinguishes a person who has failed from a failure.
Unix "guru" for sale or rent - http://www.lightconsulting.com/~travis/ -><-
GPG fingerprint: 9D3F 395A DAC5 5CCC 9066  151D 0A6B 4098 0C55 1484