Re: PF failing to block?

[Daniel Hartmeier <daniel@benzedrine.cx>]

On Mon, Feb 18, 2002 at 03:15:52PM -0500, Blair Heiserman wrote:

> I'm having some serious problems with PF. It doesn't seem to be filtering 
> everything appropriately. Specifically it seems to let browsers get through 
> to any port. I've been able to access addresses other then my web server, 
> and on non-conventional ports. When I try this with command-line utilities, 
> I am typically blocked. But browsers seem to get through. This is obviously 
> a big security problem. I have included most of my pf configuration file, 
> and a piece of the pflog which at least theoretically shows it being 
> blocked. However it still gets through despite what the pflog shows. I was 
> hoping that someone can point out a flaw in my config file.

You didn't quote a tcpdump of a packet that's supposed to be blocked but
was passed. I suggest you add 'log' to all of your rules and reproduce
the behavior. Then check the log for the packets that you don't expect
to be passed and see which rule is responsible. Without the full rule
set, and without a captured packet, it's hard to tell where the problem
is (could be one of the macros whose definition you didn't quote, for
instance).

Daniel