pf block question

[Matt Rechkemmer]

On Fri, Jun 10, 2005 at 09:33:50PM +0300, Giorgos Keramidas wrote:
> 
> Existing icmp states?
> 
> Did you reload the rules with:
> 
> 	/etc/rc.d/pf reload
> 
> or by directly running pfctl?

I tried flushing everything with pfctl -Fa, and then loading the rules with
pfctl -f /etc/pf.conf.  The script in rc.d seems to do the same thing.

After re-loading the rules, pfctl -sr yields:
root at hybrid# pfctl -sr | head -n2
scrub in all fragment reassemble
block drop quick on fxp0 from <badhosts> to any

I've verified the table has actual IP addresses.  It seems to be able to block
new TCP connections.  However, if an IP is connected currently, pf lets that
connection continue; even after flushing the states and sources.  It doesn't
seem to care about ICMP.  I can ping it from the box running pf, and receive
replies.

Am I just missing something obvious here?

--
Matt Rechkemmer
tiberius at trancell.org