🚀 go-pugleaf

This is a multi-part message in MIME format.
--------------010301020907020101020107
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit



-------- Original Message --------
Subject: 	Re: double NOT in rules is not working as expected
Date: 	Fri, 08 Apr 2011 17:00:52 +0300
From: 	Bojidara Marinchovska <quintessence@bobi.gateit.net>
To: 	Stuart Henderson <stu@spacehopper.org>



On 04/08/11 16:11, Stuart Henderson wrote:
>  On 2011/04/08 15:42, Bojidara Marinchovska wrote:
>>  It is not wrong but I cannot find it is possible to use negation with
>>  AND ( something like block in quick from !{$a, $b, $c} ) and yes as
>>  it is typed it will be produce exactly this ruleset you wrote.
>>
>>  So if rules in conf are defined as separated as ( not interpreted as
>>  subrules )
>>
>>  block in quick on $netif from !$test1 to x.x.x.x
>>  block in quick on $netif from !$test2 to x.x.x.x
>  let's fill in the macros because they really don't help.
>
>  block in quick on netif from !1.2.3.4 to x.x.x.x
>  block in quick on netif from !2.3.4.5 to x.x.x.x
>
>>  why 1.2.3.4 it is blocked by the second rule. shouldn't be passed
>>  from the first rule ? ( rules are read from top to bottom )
>  the first rule doesn't pass anything, it only blocks: it blocks
>  everything except for 1.2.3.4
>
>  so the only traffic which reaches the second rule is that from 1.2.3.4
>
>  the second rule doesn't pass anything, it only blocks: it blocks
>  everything except for 2.3.4.5
>
>  so the second rule is irrelevant because packets from 2.3.4.5 get
>  blocked at the first rule.
>
>>  So the correct question is how to accomplish
>>
>>  pass in quick on $netif from {$test1, $test2} to x.x.x.x
>>  block in quick on $netif from any to x.x.x.x
>>
>>  with only 1 rule ?
>  why do you want only 1 rule? isn't it clearer to use the two rules?
>  you might be able to do what you want with tables though, see the faq
>  about negation.
>
Hello,

Thank you, yes my mistake about block , whole day looking at the 2 rules
...
As Claudio already wrote
"

The {foo, bar} notation results in a OR operation so
foo || bar. Now !foo || !bar with foo != bar is always true.

"


As I can define with 1 rule for example
from {<tableA>,<tableB>  }
I want to be able to use also
from ! {<tableA>,<tableB>}

Yes, it is clear ...


Yes, I wrote about negation in tables, there is enough examples of its
usage in the Book Of PF, but it is not what I need ( following KISS )

Anyway thank you all
I try to accomplish something which is correct to be done with no
firewall but with other software and I try to use as simple as possible
rules

I have 2 types of lists with IPs which I put in tables (because these
IPs changes often and I don't want to reload rules, it is easy to add
just the new IP address)

table<lista>  persist file "/somefile"
table<listb>  persist file "/someotherfile"

IPs from list A have to be able to access IP A.A.A.A,B.B.B.B,C.C.C.C,
D.D.D.D and E.E.E.E for example ( protocol, port )
IPs from list B have to be able to access for example only D.D.D.D and
E.E.E.E

# block access to A.A.A.A - C.C.C.C for all except listA
block in quick on $if inet proto protocol from !<lista>  to A.A.A.A...
port ...

# here I wanted to be able to use something like to allow listA and
listB to access D.D.D.D and E.E.E.E
block in quick on $if inet proto protocol from ! {<lista>,<listb>  } to
D.D.D.D,... port ...
instead of using:
pass in quick on $if inet proto protocol from {<lista>,<listb>  } to
D.D.D.D ... port ...
block in quick on $if inet proto protocol from any to D.D.D.D ... port ...









--------------010301020907020101020107
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
  </head>
  <body bgcolor="#ffffff" text="#000000">
    <br>
    <br>
    -------- Original Message --------
    <table class="moz-email-headers-table" border="0" cellpadding="0"
      cellspacing="0">
      <tbody>
        <tr>
          <th align="RIGHT" nowrap="nowrap" valign="BASELINE">Subject: </th>
          <td>Re: double NOT in rules is not working as expected</td>
        </tr>
        <tr>
          <th align="RIGHT" nowrap="nowrap" valign="BASELINE">Date: </th>
          <td>Fri, 08 Apr 2011 17:00:52 +0300</td>
        </tr>
        <tr>
          <th align="RIGHT" nowrap="nowrap" valign="BASELINE">From: </th>
          <td>Bojidara Marinchovska <a class="moz-txt-link-rfc2396E" href="mailto:quintessence@bobi.gateit.net">&lt;quintessence@bobi.gateit.net&gt;</a></td>
        </tr>
        <tr>
          <th align="RIGHT" nowrap="nowrap" valign="BASELINE">To: </th>
          <td>Stuart Henderson <a class="moz-txt-link-rfc2396E" href="mailto:stu@spacehopper.org">&lt;stu@spacehopper.org&gt;</a></td>
        </tr>
      </tbody>
    </table>
    <br>
    <br>
    <pre>On 04/08/11 16:11, Stuart Henderson wrote:
&gt; On 2011/04/08 15:42, Bojidara Marinchovska wrote:
&gt;&gt; It is not wrong but I cannot find it is possible to use negation with
&gt;&gt; AND ( something like block in quick from !{$a, $b, $c} ) and yes as
&gt;&gt; it is typed it will be produce exactly this ruleset you wrote.
&gt;&gt;
&gt;&gt; So if rules in conf are defined as separated as ( not interpreted as
&gt;&gt; subrules )
&gt;&gt;
&gt;&gt; block in quick on $netif from !$test1 to x.x.x.x
&gt;&gt; block in quick on $netif from !$test2 to x.x.x.x
&gt; let's fill in the macros because they really don't help.
&gt;
&gt; block in quick on netif from !1.2.3.4 to x.x.x.x
&gt; block in quick on netif from !2.3.4.5 to x.x.x.x
&gt;
&gt;&gt; why 1.2.3.4 it is blocked by the second rule. shouldn't be passed
&gt;&gt; from the first rule ? ( rules are read from top to bottom )
&gt; the first rule doesn't pass anything, it only blocks: it blocks
&gt; everything except for 1.2.3.4
&gt;
&gt; so the only traffic which reaches the second rule is that from 1.2.3.4
&gt;
&gt; the second rule doesn't pass anything, it only blocks: it blocks
&gt; everything except for 2.3.4.5
&gt;
&gt; so the second rule is irrelevant because packets from 2.3.4.5 get
&gt; blocked at the first rule.
&gt;
&gt;&gt; So the correct question is how to accomplish
&gt;&gt;
&gt;&gt; pass in quick on $netif from {$test1, $test2} to x.x.x.x
&gt;&gt; block in quick on $netif from any to x.x.x.x
&gt;&gt;
&gt;&gt; with only 1 rule ?
&gt; why do you want only 1 rule? isn't it clearer to use the two rules?
&gt; you might be able to do what you want with tables though, see the faq
&gt; about negation.
&gt;
Hello,

Thank you, yes my mistake about block , whole day looking at the 2 rules 
...
As Claudio already wrote
"

The {foo, bar} notation results in a OR operation so
foo || bar. Now !foo || !bar with foo != bar is always true.

"


As I can define with 1 rule for example
from { &lt;tableA&gt;, &lt;tableB&gt; }
I want to be able to use also
from ! { &lt;tableA&gt;, &lt;tableB&gt;}

Yes, it is clear ...


Yes, I wrote about negation in tables, there is enough examples of its 
usage in the Book Of PF, but it is not what I need ( following KISS )

Anyway thank you all
I try to accomplish something which is correct to be done with no 
firewall but with other software and I try to use as simple as possible 
rules

I have 2 types of lists with IPs which I put in tables (because these 
IPs changes often and I don't want to reload rules, it is easy to add 
just the new IP address)

table &lt;lista&gt; persist file "/somefile"
table &lt;listb&gt; persist file "/someotherfile"

IPs from list A have to be able to access IP A.A.A.A,B.B.B.B,C.C.C.C, 
D.D.D.D and E.E.E.E for example ( protocol, port )
IPs from list B have to be able to access for example only D.D.D.D and 
E.E.E.E

# block access to A.A.A.A - C.C.C.C for all except listA
block in quick on $if inet proto protocol from ! &lt;lista&gt; to A.A.A.A... 
port ...

# here I wanted to be able to use something like to allow listA and 
listB to access D.D.D.D and E.E.E.E
block in quick on $if inet proto protocol from ! { &lt;lista&gt;, &lt;listb&gt; } to 
D.D.D.D,... port ...
instead of using:
pass in quick on $if inet proto protocol from { &lt;lista&gt;, &lt;listb&gt; } to 
D.D.D.D ... port ...
block in quick on $if inet proto protocol from any to D.D.D.D ... port ...







</pre>
  </body>
</html>

--------------010301020907020101020107--