Ipfw accept rule

[David Atkinson]

Are you looking for something like count? The whole idea of an allow rule
is that once it matches it is assumed that you actually do want that
packet and there is no point continuing through the ruleset. If you want
to have a general allow rule with a few specific exclusions, add one or
two deny rules for the specific cases and then have your more general
allow rule. One problem that does occur with this plan is that it becomes
very easy to overload your server with lots of rarely matched deny rules.
If you find the time in interupt going too high look at constructing some
blocks of rules and setup some skipto rules. In the case of blocking
(firewalling off) well known sources of spam, a lot of rules can be
generated very quickly. As these only apply to port 25 traffic, as skipto
can be used to skip these rules for all other traffic.

1000 skipto 2000 tcp from any to any 25
1100 skipto 4000 ip from any to any
2000 deny ip from spammer.com to any
...

HTH,
David Atkinson

On Thu, 23 Sep 2004, Bikrant Neupane wrote:

> Hi,
>  When a packet hits "allow | accept | pass | permit" rule the packet is
> accepted and the search is retiminated at that point.
>
> I need to accept the packet but still want the packet to continue travers
> rules further below. However, once it hits "deny | drop" rule it should be
> dropped and the search should terminate at that point. Is that possible with
> IPFW?
>
> regards,
> Bikrant
>
>
> _______________________________________________
> freebsd-isp at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-isp
> To unsubscribe, send any mail to "freebsd-isp-unsubscribe at freebsd.org"
>