pf block question

Matt Rechkemmer tiberius at
Sun Jun 19 03:47:28 GMT 2005

On Fri, Jun 10, 2005 at 09:33:50PM +0300, Giorgos Keramidas wrote:
> Existing icmp states?
> Did you reload the rules with:
> 	/etc/rc.d/pf reload
> or by directly running pfctl?

I tried flushing everything with pfctl -Fa, and then loading the rules with
pfctl -f /etc/pf.conf.  The script in rc.d seems to do the same thing.

After re-loading the rules, pfctl -sr yields:
root at hybrid# pfctl -sr | head -n2
scrub in all fragment reassemble
block drop quick on fxp0 from <badhosts> to any

I've verified the table has actual IP addresses.  It seems to be able to block
new TCP connections.  However, if an IP is connected currently, pf lets that
connection continue; even after flushing the states and sources.  It doesn't
seem to care about ICMP.  I can ping it from the box running pf, and receive

Am I just missing something obvious here?

Matt Rechkemmer
tiberius at

More information about the freebsd-questions mailing list