[ndbug] PF question

N.J. Thomas njt at ayvali.org
Fri May 1 02:03:19 EDT 2015

* Hrishikesh Muruk <hrishim at gmail.com> [2015-05-01 05:54:40+0530]:
> Ok. I still don't understand this bit.
> In the list example you mentioned that the address will not match
> rule B

Correct. A packet from that address, given this ruleset:

    A) pass in on fxp0 from
    B) pass in on fxp0 from !

Will match rule A, and will not match rule B.

> In the table example
> table <goodguys> {, ! }
> pass  in on fxp0 from <goodguys> to any
> The address will match the first entry. Based on your first
> explanation I don't understand how it will match the 2 entry

No, a packet from will NOT match in that table.

You are confusing how lists are expanded and how tables are
evaluated. Tables are evaluated with the most specific address.

So given this table:

    table <goodguys> {, ! }

A packet from is certainly in the subnet (which is a /8), but
it matches more specifically to the second address, ! because a
specific IP address can be considered to have a subnet of /32. A /32 is
more specific than a /8.

I'm sorry if that wasn't clear in my earlier email.


More information about the talk mailing list