<br><br>On Thursday 30 April 2015, N.J. Thomas <<a href="mailto:njt@ayvali.org">njt@ayvali.org</a>> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Hrishikesh Muruk <<a href="javascript:;" onclick="_e(event, 'cvml', 'hrishim@gmail.com')">hrishim@gmail.com</a>> [2015-04-30 22:12:28+0530]:<br>
> Based on the section on tables from the same FAQ. I believe this will<br>
> work<br>
><br>
> table <goodguys> { <a href="http://10.0.0.0/8" target="_blank">10.0.0.0/8</a>, !10.1.2.3 }<br>
> pass in on fxp0 from <goodguys> to any<br>
<br>
Yes, that will also do what you want to do.<br>
<br>
> Lists replicate the rule for each item. How do tables expand?<br>
<br>
Tables are not expanded like lists. Matching for tables are against the<br>
most narrowly matching entry. See this page:<br>
<br>
<a href="http://www.openbsd.org/faq/pf/tables.html#match" target="_blank">http://www.openbsd.org/faq/pf/tables.html#match</a><br>
<br>
So you could have a table and ruleset like this:<br>
<br>
table <goodguys> { <a href="http://172.16.0.0/16" target="_blank">172.16.0.0/16</a>, !<a href="http://172.16.1.0/24" target="_blank">172.16.1.0/24</a>, 172.16.1.100 }<br>
block in on dc0<br>
pass in on dc0 from <goodguys><br>
<br>
So anything in 172.16.1.xx is blocked, because of the negation, but<br>
172.16.1.100 goes through because it is exactly matched.<br>
<br>
<br></blockquote><div>Ok. I still don't understand this bit. </div><div>In the list example you mentioned that the address 10.1.2.3 will not match rule B</div><div><br></div><div>In the table example</div><div><span style="background-color:rgba(255,255,255,0)">t</span><span style="background-color:rgba(255,255,255,0);font-size:small">able <goodguys> { </span><a href="http://10.0.0.0/8" target="_blank" style>10.0.0.0/8</a><span style="background-color:rgba(255,255,255,0);font-size:small">, !10.1.2.3 }</span><br></div><div><font size="2"><span style="background-color:rgba(255,255,255,0)">pass in on fxp0 from <goodguys> to any</span></font><br></div><div><font size="2"><span style="background-color:rgba(255,255,255,0)"><br></span></font></div><div><font size="2"><span style="background-color:rgba(255,255,255,0)">The address 10.1.2.3 will match the first entry. Based on your first explanation I don't understand how it will match the 2 entry</span></font></div><div> <span></span></div>