Re: double NOT in rules is not working as expected

Article View: bit.listserv.openbsd-pf

Article #76

Back to bit.listserv.openbsd-pf Previous Next

#76

From: Daniel Hartmeier
Date: Fri, 08 Apr 2011 14:10

20 lines
1452 bytes

On Fri, Apr 08, 2011 at 03:42:41PM +0300, Bojidara Marinchovska wrote:

> So the correct question is how to accomplish
> 
> pass in quick on $netif from {$test1, $test2} to x.x.x.x
> block in quick on $netif from any to x.x.x.x
> 
> with only 1 rule ?

While negating a list never does what you want, negating a table
does the expected:

  table <test> const { 1.2.3.4, 2.3.4.5 }
  block from ! <test> to x.x.x.x

The rule matches any source except 1.2.3.4 and 2.3.4.5.

See http://www.openbsd.org/faq/pf/tables.html for more examples.

Daniel

Technical Details

Message-ID: <20110408133929.GB8259@insomnia.benzedrine.cx>

Path:

arc1-ca.pugleaf.net!g2news2.google.com!news1.google.com!npeer03.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrn

References: <4D9EE14F.5010400@bobi.gateit.net> <20110408110426.GA28519@diehard.n-r-g.com> <4D9F02C1.3050901@bobi.gateit.net>

Show Full Headers

Complete Article Headers

X-Google-Thread: ff4ef,d780e65cf81f4123
X-Google-NewGroupId: yes
X-Google-Attributes: gidbffa70e3,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news2.google.com!news1.google.com!npeer03.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrn
From: daniel@benzedrine.cx (Daniel Hartmeier)
Newsgroups: bit.listserv.openbsd-pf
Subject: Re: double NOT in rules is not working as expected
Date: 8 Apr 2011 07:10:19 -0700
Organization: None
Lines: 20
Message-ID: <20110408133929.GB8259@insomnia.benzedrine.cx>
References: <4D9EE14F.5010400@bobi.gateit.net> <20110408110426.GA28519@diehard.n-r-g.com> <4D9F02C1.3050901@bobi.gateit.net>
NNTP-Posting-Host: localhost.newsguy.com
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
NNTP-Posting-Date: 8 Apr 2011 14:10:19 GMT

Reply to Parent Message