[ previous ] [ next ] [ threads ]
 
 From:  "Manuel Kasper" <mk at neon1 dot net>
 To:  "T. Lechat" <m0n0wall at lechat dot org>
 Cc:  m0n0wall at lists dot m0n0 dot ch
 Subject:  Re: [m0n0wall] pb22r566 : No effect of 'Disabled Log blocked packets by default' + other question
 Date:  Sun, 14 Dec 2003 10:49:25 +0100 (CET) 
T. Lechat said:
> 1) I have just updated to pb22r566 from pb21 : It Seems that 'Disabled Log
> blocked packets by default' doesn't have any effect. m0n0wall continues to
> log default packet (after reboot too). I disabled too all log for all my
> rules. Maybe I've missed something else ?

Nope, I forgot that some (but not all) of the implicit block rules that
are installed automatically by the filter rule generator still have the
'log' keyword set. If it bothers you, use the attached patch against
filter.inc. It will be fixed in the next release.

- Manuel
--- filter.inc.orig	Sun Dec 14 10:42:37 2003
+++ filter.inc	Sun Dec 14 10:42:57 2003
@@ -308,13 +308,13 @@
 	$ipfrules .= <<<EOD
 
 # WAN spoof check
-block in log quick on $wanif from $lansa/$lansn to any
+block in quick on $wanif from $lansa/$lansn to any
 
 EOD;
 
 	foreach ($optcfg as $oc) {
 		if (!$oc['bridge'])
-			$ipfrules .= "block in log quick on $wanif from {$oc['sa']}/{$oc['sn']} to any\n";
+			$ipfrules .= "block in quick on $wanif from {$oc['sa']}/{$oc['sn']} to any\n";
 	}
 	
 	/* allow PPTP traffic if PPTP client is enabled on WAN */
@@ -336,7 +336,7 @@
 # XXX - should be more restrictive
 # (not possible at the moment - need 'me' like in ipfw)
 pass out quick on $wanif proto udp from any port = 68 to any port = 67
-block in log quick on $wanif proto udp from any port = 67 to $lansa/$lansn port = 68
+block in quick on $wanif proto udp from any port = 67 to $lansa/$lansn port = 68
 pass in quick on $wanif proto udp from any port = 67 to any port = 68
 
 # LAN/OPT spoof check (needs to be after DHCP because of broadcast addresses)
@@ -380,7 +380,7 @@
 #---------------------------------------------------------------------------
 # group head 200/250 - WAN interface
 #---------------------------------------------------------------------------
-block in log quick on $wanif all head 200
+block in quick on $wanif all head 200
 block out quick on $wanif all head 250
 
 EOD;