Tag Info

Hot answers tagged


its because its specifying a single ip, you need to write it with the subnet: pass in from man pf.conf should list a few methods of defining ranges and blocks. A side note, take care to ensure there are no drop quick kind of rules above your pass, and no rules below that could accidently match and block your packets.


Officially you can't mix them. Unofficially various incantations and sacrifices might lead to a working, though precarious, configuration. In any case it's simply not recommended. Also, why not just use one or the other? I assume you're wanting dummynet to do some per-endpoint bandwidth limiting, if not PF might be all you need. Similarly, IPFW can do ...


You have to quote the subnet mask addresses again (with single quotes) when defining: subnet1 = "''" subnet2 = "''" subnets = "{" $subnet1 $subnet2 "}" Sadly this doesn’t appear to be documented anywhere.


I too was facing this issue and it took quiet a bit of testing and tcpdump to figure it all out. To answer your first question, which one the rule 7/0(match) is: It is the "Generic_blocks_(IPv4)" rule automatically added by IceFloor to block and log all non-explicitly authorized traffic. You can confirm that rule's number by running pfctl -gsr as root. On ...

Only top voted, non community-wiki answers of a minimum length are eligible