INTELLIGENT WORK FORUMS
FOR COMPUTER PROFESSIONALS

Member Login

Come Join Us!

Are you a
Computer / IT professional?
Join Tek-Tips now!

Talk With Other Members
Be Notified Of Responses
To Your Posts
Keyword Search
One-Click Access To Your
Favorite Forums
Automated Signatures
On Your Posts
Best Of All, It's Free!

*Tek-Tips's functionality depends on members receiving e-mail. By joining you are opting in to receive e-mail.

LINK TO THIS FORUM!

Tek-Tips LinkedIn^® Group

Join our
LinkedIn^® Group!

Hook up with past and present colleagues and classmates quickly.

Partner With Us!

"Best Of Breed" Forums Add Stickiness To Your Site

(Download This Button Today!)

Feedback

"...The forum looks great! You guys have done a fantastic job on arranging things there...Your site is very precise and fun to visit..."

More...

Geography

Where in the world do Tek-Tips members come from?

Click Here To Find Out!

Tek-Tips Shirts!

Get your
Tek-Tips Forums
SWAG here!

Home > Forums > MIS/IT > Security Solutions > Darren Reed: IP Filter Forum

log outgoing messages

Read More Threads Like This One

reverseng (TechnicalUser)

3 Oct 11 9:31

I have a lot of outgoing pass rules but for some reason some outgoing messages are blocked.

therefor I added as the last of the outgoing rules:

pass out log quick from any to any

doing so I hoped to see all the outgoing messages that were not
covered by the other outgoing rules.

is this reasoning correct?

the outgoing rule which were already in place are:
pass out quick on e1000g2 proto tcp from any to any keep state keep frags
pass out quick on e1000g2 proto udp from any to any keep state keep frags
pass out quick on e1000g2 proto udp from any to any with frag-body

and this for every interface in the system.
The messages, which are udp messages all com in on the same interface but are going out on another. the incoming rule is:

block in log quick on e1000g1 all head 40
pass in quick on e1000g2 proto udp from any to 10.10.10.0/25 port = 2222 keep state keep frags group 40

the same on e1000g5 interface. messages port 2222 are coming in on interface e1000g5 and going out on e1000g1.

some of these are blocked. I would like to log these blocked messages. any idea of how to do that?

BTW: there is no problem when ipf is disabled.

tnx in advance

Reply To This Thread

Posting in the Tek-Tips forums is a member-only feature.

Click Here to join Tek-Tips and talk with other members!

Back To Forum

Back To Darren Reed: IP Filter