On 17.12.2004 23:27 +0100, Frederick Page wrote:

> However as I said: on the LAN-interface everything works as
> expected: changing the last "pass" rule to "destination not OPT1"
> prevents any traffic to OPT1. It just doesn't work the other way
> round: prevent traffic from OPT1 to LAN.

Why on earth do you have a static route for 192.168.0.0/16 with
gateway 192.168.100.100 on your *OPT1* interface? Not only does that
not make any sense, it's the source of your problem as well. That
static route tells m0n0wall to let traffic between 192.168.0.0/16 and
192.168.101.0/24 pass unconditionally, since it assumes that both are
on the same interface (OPT1). Remove it, and life should be better
for you.

Lesson learned: don't use the words "confirmed" and "bug" unless
you're really really sure you did everything right...

Now, I've learned a lesson too. This automatic implicit routing
feature will be made optional, with default to disabled, in the very
next release. It wasn't my idea, I didn't like it that much anyway
(even though it's needed in some complicated setups), and it's too
easy for a user to do something stupid with the static routing and
end up with filter rules that don't do what (s)he wants them to.

- Manuel