>>I see the following in the firewall log:
>> 11:00:40.258164 sis2 @0:8 B 192.168.250.1,514 -> 192.168.252.2,514
>>PR udp len 20 149 OUT
>That says rule 8 in set 0 blocked the traffic. Which rule is 8?
Rule 8 is the default block rule and my point was that it gets to that rule
because none of the pass rules match. My point was that rule 2, which I
think was supposed to handle the syslog traffic doesn't work since the
source ips doesn't match.
>> From the status page I found the following auto generated pass rule
>>under the ipfstat -nio section:
>> @2 pass out quick proto udp from 192.168.252.1/32 to
>>192.168.252.0/24 port = 514 keep state group 450
>That's rule 2. It's not the one that blocked the traffic.