🚀 go-pugleaf

On 11 Kwi, 16:17, rafalsle...@gmail.com wrote:
> Situation is very simple
>
> I log only block rules, but when i tcpdump pflog0 interface i saw pass
> rules are logged to, why ?
> there is no "log" syntax in pass rules
>
> tcpdump -i pflog0
> 15:33:48.264883 rule 122/8(ip-option): pass in on fxp0: 192.168.1.9 >
> 224.0.0.22: igmp v3 report, 1 group record(s)
> 15:33:48.307721 rule 122/8(ip-option): pass in on fxp0: 192.168.1.9 >
> 224.0.0.22: igmp v3 report, 1 group record(s)
> 15:33:48.324948 rule 122/8(ip-option): pass in on fxp0: 192.168.1.9 >
> 224.0.0.22: igmp v3 report, 1 group record(s)
> 15:33:52.287771 rule 122/8(ip-option): pass in on fxp0: 192.168.1.9 >
> 224.0.0.22: igmp v3 report, 1 group record(s)
> 15:33:52.290652 rule 122/8(ip-option): pass in on fxp0: 192.168.1.9 >
> 224.0.0.22: igmp v3 report, 1 group record(s)
> 15:33:52.443273 rule 122/8(ip-option): pass in on fxp0: 192.168.1.9 >
> 224.0.0.22: igmp v3 report, 1 group record(s)
>
> serwer# pfctl -vvsr | grep log
> set loginterface $ext_if
> @0 block drop in log quick from <ssh_bruteforce:0> to any
> @1 block drop out log quick from any to <ssh_bruteforce:0>
> @2 block drop in log quick on fxp1 from <iana_reserved:41> to any
> @3 block drop out log quick on fxp1 from any to <iana_reserved:41>
> @4 block return-rst log quick on fxp1 proto tcp all flags /S
> @5 block return-rst log quick on fxp1 proto tcp all flags A/A
> @6 block drop log all
> @7 block return-rst log inet proto tcp all
> @8 block return-icmp(port-unr) log inet proto udp all
> @9 block return-rst in log quick on fxp1 proto tcp from any to any
> port = sunrpc
> @10 block return-rst in log quick on fxp1 proto tcp from any to any
> port = socks
> @11 block return-rst in log quick on fxp1 proto tcp from any to any
> port = x11
> @12 block return-rst in log quick on fxp1 proto tcp from any to any
> port = ircd
> @13 block return-icmp(port-unr, port-unr) in log quick on fxp1 proto
> udp from any to any port 135 >< 139
> @14 block return-icmp(port-unr, port-unr) in log quick on fxp1 proto
> udp from any to any port = ms-sql-m
> @15 block return-icmp(port-unr, port-unr) in log quick on fxp1 proto
> udp from any to any port = microsoft-ds
> @16 block return-icmp(port-unr, port-unr) out log quick on fxp1 proto
> udp from any to any port 135 >< 139
> @17 block return-icmp(port-unr, port-unr) out log quick on fxp1 proto
> udp from any to any port = ms-sql-m
> @18 block return-icmp(port-unr, port-unr) out log quick on fxp1 proto
> udp from any to any port = microsoft-ds
> @19 block drop out log quick on fxp1 inet from ! 80.53.140.166 to any
>
> pfctl -vvsr | grep @122
> @122 pass in on fxp0 inet from 192.168.1.9 to any flags S/SA keep
> state label "client33" queue 33_in
> (local client, going throught nat to internet)
>
> fxp0 - internal interface - 192.168.1.0/24
> fxp1 - public interface - IP from ISP
>
> uname -a
> FreeBSD serwer 7.2-PRERELEASE FreeBSD 7.2-PRERELEASE #3: Fri Apr 10
> 15:37:55 CEST 2009     klikacz@serwer:/usr/obj/usr/src/sys/GENERIC
> i386
> kernel GENERIC + ALTQ (nothing more)
>
> any idea ?

One more thing, in block log, rule 122 is related with rule number 8,
so why it's figure in log with number 122 not 8?