On Tue, 10 Jun 2003, Dan Nelson wrote: > In the last episode (Jun 11), Andre Guibert de Bruet said: > > > > Now I realize that the broadcast address doesn't match the network > > card's IP address, which is why the packet isn't getting matched. But > > do we really want this behavior? Don't broadcasts affect all machines > > on the subnet and therefore qualify for "me" matching? > > "me" was more designed for allow rules when you have a dynamic IP. It > lets you set up rules that are guaranteed to work no matter what your > current IP is. Does this do what you want: > > deny udp from 192.168.1.0/24 to any dst-port 137,138 in via dc0 I ended up using that exact rule when I realized what was going on; And yes it does drop the packets as intended. > Andre Guibert de Bruet | Enterprise Software Consultant > > Silicon Landmark, LLC. | http://siliconlandmark.com/ >Received on Tue Jun 10 2003 - 20:25:15 UTC
This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:37:11 UTC