Need a little PF help here, please...
Greg Hennessy
Greg.Hennessy at nviz.net
Sun Oct 8 23:47:09 PDT 2006
> However, if
> I comment out the PF rule "block in all" then suddenly I can ping
> yahoo.com. Why will my server not resolve names (like
> yahoo.com) if the
> "block in all" statement exists? Why does that statement mess it up?
> What am I missing? Please help because I am totally frustrated.
>
>
>
> block in all
The default block rule should always have logging enabled, no exceptions.
It should be
block log all
The pf logs would have told you straight away what was being dropped and
why.
On a side note,
The default block rule should match both ingress and egress traffic.
A system cannot be deemed secure it if implictly allows egress traffic to
flow.
Greg
More information about the freebsd-pf
mailing list