ipfw subnetting

[Paul Macdonald]

On 21/05/2012 14:50, Ian Smith wrote:
> In freebsd-questions Digest, Vol 416, Issue 1, Message: 26
> On Mon, 21 May 2012 10:06:12 +0100 Paul Macdonald<paul at ifdnrg.com>  wrote:
>
>   >  can anyone suggest what i'm doing wrong here.
>   >
>   >  Desired:    drop everything from 180.0.0.0 to 180.255.255.255
>   >
>   >  ipfw -q add 137 deny all from 180.0.0.0/8 to any
>
> t23# ipfw -q add 137 deny all from 180.0.0.0/8 to any
> t23# ipfw show 137
> 00137    0       0 deny ip from 180.0.0.0/8 to any
>
> So what doesn't work?  (apart from scattergun removal of small pieces of
> a whole lot of Asian countries, incl. Japan, Indonesia, Australia, .. :)
it was intended as a required temporary measure,
but even though it was listed in my ipfw list, i was/am still seeing 
traffic coming in via addresses such as 180.248.x.x


A very open firewall test script is as follows:

00010 allow ip from any to any via lo0
00081 deny log ip from 180.0.0.0/8 to any
00100 check-state
00101 allow tcp from any to any established
00102 allow ip from any to any out keep-state
00103 allow icmp from any to any
65535 deny ip from any to any

but i'm still seeing traffic from

180.149.29.102
180.234.116.61
180.234.36.44
180.234.237.119
180.234.72.115

I must be doing something wrong!
Paul.





> cheers, Ian
> _______________________________________________
> freebsd-questions at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to "freebsd-questions-unsubscribe at freebsd.org"


-- 
-------------------------
Paul Macdonald
IFDNRG Ltd
Web and video hosting
-------------------------
t: 0131 5548070
m: 07970339546<<PLEASE NOTE NEW MOBILE<<
e: paul at ifdnrg.com
w: http://www.ifdnrg.com
-------------------------
IFDNRG
40 Maritime Street
Edinburgh
EH6 6SA
-------------------------