Firewall problem

[Gary]

On Wed, Oct 01, 2003 at 02:24:51PM -0400 or thereabouts, Rob Ellis wrote:
> On Wed, Oct 01, 2003 at 01:18:17PM -0500, Gary wrote:
> > I am getting a lot of virus activity on my SMTP port 25. So I wanted to
> > drop a few IP ranges/addresses..
> > 
> > 00100  62054   5483792 allow ip from any to any via lo0
> > 00200      0         0 deny ip from any to 127.0.0.0/8
> > 00300      0         0 deny ip from 127.0.0.0/8 to any
> > 65000 873327 293931424 allow ip from any to any
> > 65100      0         0 deny tcp from 24.92.226.153 to any
> > 65110      0         0 deny ip from 213.191.102.86 to any           
> > 65535      0         0 deny ip from any to any
> > 
> > Yet, checking later in my SMTP logs, I am still getting pounded by the
> > listed addresses. Can anyone explain why this isn't working?
> > 
> 
> Your deny rules have to be added before the 'allow ip from any to any'.
> 
>   ipfw add 100 deny tcp from 24.92.226.153 to any

Ah, yes, I can see that.  Thanks very much guys for your input.  

Appreciate the input... works well now.. 
 

-- 
Gary