is there a way to tag the packets going to pflog, i can see the
packets being blocked with tcpdump on /var/log/pflog, but i would like
to know what rule is blocking them

i changed my rules a little bit here is the output of pfctl -s rules,
i was hoping that explictly defining some of these would help but same
result

block return in log on xl0 all
block drop in log on xl1 all
pass in on xl0 inet from any to 192.168.25.253 keep state
pass in on xl1 inet from 192.168.25.253 to any keep state
pass out on xl0 all
pass out on xl1 all
pass in on xl0 inet from any to 192.168.25.33
pass in on xl1 inet from 192.168.25.33 to any
pass in on xl0 inet from any to 192.168.25.69
pass in on xl1 inet from 192.168.25.69 to any
pass in on xl0 inet from any to 192.168.25.84
pass in on xl1 inet from 192.168.25.64 to any
pass in on xl0 inet from any to 192.168.25.100
pass in on xl1 inet from 192.168.25.100 to any
pass in on xl0 inet from any to 192.168.25.201
pass in on xl1 inet from 192.168.25.201 to any
pass in on xl0 inet from any to 192.168.25.252
pass in on xl1 inet from 192.168.25.252 to any

On 20/03/07, Stuart Henderson <stu@spacehopper.org> wrote:
quoted text
> On 2007/03/20 06:18, Lawrence Horvath wrote:
> > On 20/03/07, Stuart Henderson <stu@spacehopper.org> wrote:
> > >On 2007/03/20 04:41, Lawrence Horvath wrote:
> > >> I have the below rule set in my pf.conf, i am having the following
> > >> problem, i need to be able to log into the firewall with ssh from
> > >> outside, and nothing should be able to hit the firewall from inside,
> > >> not even ping
> > >
> > >You don't "pass out" anything, either directly or via keep state.
> > >Also see the Notes section of bridge(4).
>
> ahh, I missed that you have a default "pass out" since your default
> blocks are only for inbound.
>
> tcpdump on various interfaces (including pflog0 with the relevant log
> keywords adding to pf.conf) will help you see how it works. Some things
> depend on which interface has the IP address.
>
> The advice in bridge(4) about passing/skipping traffic on one of the
> interfaces makes things easier to follow.
>
>


-- 
-Lawrence
-Student ID 1028219
-CCNA