pf: nat works, ip blocking and logging do not

[David DeSimone]

Alex Teslik <whereisalext at gmail.com> wrote:
>
> Unfortunately, I can still go to 11.11.11.111 or 22.22.22.222 with no
> blocking and no logging on /var/log/pflog.

Your outbound traffic first matches this rule:

> pass out all [keep state]

The [keep state] I added because it is implied; you would have to
explicitly add "no state" in order to avoid it, and you probably
actually do want state-tracking on most outbound connections.

This is important to your question, though, because if you open an
outbound connection to 11.11.11.111 or 22.22.22.222, it will store a
state entry, and state entries are checked BEFORE any rule-checking, for
reply traffic coming back from those hosts.  So, these rules:

> block drop in log (all) quick on $ext_if from { 11.11.11.111, 22.22.22.222 } to any
> block drop out log (all) quick on $ext_if from { 11.11.11.111, 22.22.22.222 } to any

will never be checked, because they match the previously built state.

In order to prevent communications with these hosts, you must also add
"block out [quick]" rules which prevent you from initiating the
connection to them and thus building state entries.

-- 
David DeSimone == Network Admin == fox at verio.net
  "I don't like spinach, and I'm glad I don't, because if I
   liked it I'd eat it, and I just hate it." -- Clarence Darrow


This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio, Inc. makes no warranty that this email is error or virus free.  Thank you.