PF blocking even if set to pass all

RW fbsd06 at
Thu Dec 13 14:40:20 PST 2007

On Thu, 13 Dec 2007 21:17:09 +0100
Erik Norgaard <norgaard at> wrote:

> I think it is possible to set a default rule, which for security
> should be block, which means that any packet that falls through your
> rule set will be blocked. 

I'm not aware that there is, the FAQ suggests having 

block in  all
block out all

at the top.

> Therefore, you should have "pass quick".

With PF the last rule to be hit will be used, which means the default
is normally applied at the beginning  and then overridden. You don't
need quick to avoid dropping off the bottom of the rules, unless you
are trying to replicate an IPFW script in PF.

More information about the freebsd-questions mailing list