Very Computer

by **Davi** » Fri, 07 Jul 2000 04:00:00

Hey guys I need some help. I understand how the rule groups work with ipf
but this i don't understand if I have this
1: pass in log quick on ne3 from any to any head 20 (numbers are for
reference)
2: pass in quick on ne3 proto tcp/udp from 24.88.1.66 to any port =
53 group 20
3: pass in quick on ne3 proto tcp/udp from 24.88.1.67 to any port =
53 group 20
does rule #1 nullify rules 2 and 3 and everything gets passed or what? this
i don't understand this is not my complete ipf.rules file have no worries. I
just think that rule #1 is bypassing rules #2,3 should i take out quick or
what? Any help will be greatly apperciated thanks.....
David

by **Pete** » Fri, 07 Jul 2000 04:00:00

The quick keyword works as you describe. Normally all rules are evaluated
and the last matching rule will determine the action taken for any given
packet. The quick keyword changes this behaviour, so that if a packet matches a
rule with the "quick" keyword, that rule's action is activated with immediate
effect, *before* any further rules are evaluated.

Therefore, any packets that match rule 1 in your example, will never be tested
against rules 2 & 3 as you have already allowed them to pass.

If you remove the "quick" keyword from rule 1, then packets that match rule 1
will still be tested against rules 2 & 3.

Peter.

pdebono at chello point nl

rule groups work with ipf >but this i don't understand if I have this

Quote:>1: pass in log quick on ne3 from any to any head 20 (numbers are for
>reference)
>2: pass in quick on ne3 proto tcp/udp from 24.88.1.66 to any port =
>53 group 20
>3: pass in quick on ne3 proto tcp/udp from 24.88.1.67 to any port =
>53 group 20
>does rule #1 nullify rules 2 and 3 and everything gets passed or what? this
>i don't understand this is not my complete ipf.rules file have no worries. I
>just think that rule #1 is bypassing rules #2,3 should i take out quick or
>what? Any help will be greatly apperciated thanks.....
>David

by **Davi** » Fri, 07 Jul 2000 04:00:00

thanks for the help peter

The quick keyword works as you describe. Normally all rules are evaluated
and the last matching rule will determine the action taken for any given
packet. The quick keyword changes this behaviour, so that if a packet
matches a
rule with the "quick" keyword, that rule's action is activated with
immediate
effect, *before* any further rules are evaluated.

Therefore, any packets that match rule 1 in your example, will never be
tested
against rules 2 & 3 as you have already allowed them to pass.

If you remove the "quick" keyword from rule 1, then packets that match rule
1
will still be tested against rules 2 & 3.

Peter.

pdebono at chello point nl

how the
rule groups work with ipf >but this i don't understand if I have this

Quote:>1: pass in log quick on ne3 from any to any head 20 (numbers are for
>reference)
>2: pass in quick on ne3 proto tcp/udp from 24.88.1.66 to any port
=
>53 group 20
>3: pass in quick on ne3 proto tcp/udp from 24.88.1.67 to any port
=
>53 group 20
>does rule #1 nullify rules 2 and 3 and everything gets passed or what? this
>i don't understand this is not my complete ipf.rules file have no worries.
I
>just think that rule #1 is bypassing rules #2,3 should i take out quick or
>what? Any help will be greatly apperciated thanks.....
>David

Very Computer

Ipf rulegroups and construction

Ipf rulegroups and construction

Ipf rulegroups and construction

Ipf rulegroups and construction