[ndbug] PF question

Hrishikesh Murukkathampoondi hrishim at gmail.com
Thu Apr 30 06:53:26 EDT 2015


I have a PF related question.

The macros section of PF FAQ (http://www.openbsd.org/faq/pf/macros.html) says

Beware of constructs like the following, dubbed "negated lists", which are a common mistake:

pass in on fxp0 from {, ! }
While the intended meaning is usually to match "any address within, except for", the rule expands to:

pass in on fxp0 from
pass in on fxp0 from !


But doesn’t PF apply the last matching rule? That means, in this example, will be blocked (as desired) and any other address conforming to will be passed through.


More information about the talk mailing list