[posted and cc'ed]
On Tue, 5 Oct 2004, Chris Buechler wrote:
>> ipmon: 11:07:08.443851 sis0 @0:15 b
>> 192.168.1.51,63864 -> 126.96.36.199,993 PR tcp len 20 101 -AFP IN
> What is group 0 rule 15 in /status.php (the first rule 15 it shows
> under ipfstat -nio)?
@15 block in log quick proto tcp from any to any
which I guess is the implicit block rule. But, rule @0:14 says,
@14 skip 1 in proto tcp from any to any flags S/FSRA
which I guess means skip to group 1 for TCP packets with the S/FSRA
flag(s) set. And what I assume is the relevant rule in what I guess is
group 1 is
@3 pass in quick from 192.168.1.0/24 to any keep state group 100
While I don't think that this should be part of the problem, was it a
mistake to set my LAN address as 192.168.1.0/24 instead of 192.168.0.0/24?
>> Also I'd like to get recommendations for good books on packet filtering
>> firewalls including NAT.
> Not a book, but something to start with at least. Has a good
> explanation of deciphering IPF's logs.
Jeffrey Goldberg http://www.goldmark.org/jeff/
Relativism is the triumph of authority over truth, convention over justice
Hate spam? Boycott MCI! http://www.goldmark.org/jeff/anti-spam/mci/