Re: IPF 4.1 does not block broadcasts

On Wed, Feb 18, 2004 at 11:05:56AM +0100, Hans Werner Strube wrote:
> With rules
>
> block in log on elxl0 all
> pass in quick on elxl0 proto tcp from x.y.z.0/24 to x.y.z.h/32 flags S keep state
>
> on ipf host x.y.z.h, broadcasts from other hosts in subnet x.y.z.0 to x.y.z.255
> (the broadcast address of subnet x.y.z.0) are blocked and logged with ipf
> 3.4.33 but neither blocked nor logged with 4.1. Bug or feature?
> (OS: Solaris 7)

From what I've seen, the logic in both versions of ipfilter is equal.

Your block rule does not have quick. Are you sure that your default
is not to pass? (look with ipf -V)

-Guido