🚀 go-pugleaf

Situation is very simple

I log only block rules, but when i tcpdump pflog0 interface i saw pass
rules are logged to, why ?
there is no "log" syntax in pass rules


tcpdump -i pflog0
15:33:48.264883 rule 122/8(ip-option): pass in on fxp0: 192.168.1.9 >
224.0.0.22: igmp v3 report, 1 group record(s)
15:33:48.307721 rule 122/8(ip-option): pass in on fxp0: 192.168.1.9 >
224.0.0.22: igmp v3 report, 1 group record(s)
15:33:48.324948 rule 122/8(ip-option): pass in on fxp0: 192.168.1.9 >
224.0.0.22: igmp v3 report, 1 group record(s)
15:33:52.287771 rule 122/8(ip-option): pass in on fxp0: 192.168.1.9 >
224.0.0.22: igmp v3 report, 1 group record(s)
15:33:52.290652 rule 122/8(ip-option): pass in on fxp0: 192.168.1.9 >
224.0.0.22: igmp v3 report, 1 group record(s)
15:33:52.443273 rule 122/8(ip-option): pass in on fxp0: 192.168.1.9 >
224.0.0.22: igmp v3 report, 1 group record(s)


serwer# pfctl -vvsr | grep log
set loginterface $ext_if
@0 block drop in log quick from <ssh_bruteforce:0> to any
@1 block drop out log quick from any to <ssh_bruteforce:0>
@2 block drop in log quick on fxp1 from <iana_reserved:41> to any
@3 block drop out log quick on fxp1 from any to <iana_reserved:41>
@4 block return-rst log quick on fxp1 proto tcp all flags /S
@5 block return-rst log quick on fxp1 proto tcp all flags A/A
@6 block drop log all
@7 block return-rst log inet proto tcp all
@8 block return-icmp(port-unr) log inet proto udp all
@9 block return-rst in log quick on fxp1 proto tcp from any to any
port = sunrpc
@10 block return-rst in log quick on fxp1 proto tcp from any to any
port = socks
@11 block return-rst in log quick on fxp1 proto tcp from any to any
port = x11
@12 block return-rst in log quick on fxp1 proto tcp from any to any
port = ircd
@13 block return-icmp(port-unr, port-unr) in log quick on fxp1 proto
udp from any to any port 135 >< 139
@14 block return-icmp(port-unr, port-unr) in log quick on fxp1 proto
udp from any to any port = ms-sql-m
@15 block return-icmp(port-unr, port-unr) in log quick on fxp1 proto
udp from any to any port = microsoft-ds
@16 block return-icmp(port-unr, port-unr) out log quick on fxp1 proto
udp from any to any port 135 >< 139
@17 block return-icmp(port-unr, port-unr) out log quick on fxp1 proto
udp from any to any port = ms-sql-m
@18 block return-icmp(port-unr, port-unr) out log quick on fxp1 proto
udp from any to any port = microsoft-ds
@19 block drop out log quick on fxp1 inet from ! 80.53.140.166 to any



pfctl -vvsr | grep @122
@122 pass in on fxp0 inet from 192.168.1.9 to any flags S/SA keep
state label "client33" queue 33_in
(local client, going throught nat to internet)

fxp0 - internal interface - 192.168.1.0/24
fxp1 - public interface - IP from ISP

uname -a
FreeBSD serwer 7.2-PRERELEASE FreeBSD 7.2-PRERELEASE #3: Fri Apr 10
15:37:55 CEST 2009     klikacz@serwer:/usr/obj/usr/src/sys/GENERIC
i386
kernel GENERIC + ALTQ (nothing more)

any idea ?