>[оверквотинг удален]
>>
>>12:46:03.604896 IP 192.168.1.2.137 > 192.168.1.255.137: NBT UDP PACKET(137) QUERY; REQUEST; BROADCAST
>>12:46:04.352688 IP 192.168.1.2.137 > 192.168.1.255.137: NBT UDP PACKET(137) QUERY; REQUEST; BROADCAST
>>12:46:05.102964 IP 192.168.1.2.137 > 192.168.1.255.137: NBT UDP PACKET(137) QUERY; REQUEST; BROADCAST
>>
>>это как так может быть 7
>
>block all log
>это весь конфиг pf?
>какие адреса интерфейсов? adsl="dc0"
zavod="fxp0"
free="{192.168.1.250 192.168.4.250}"
friends="{217.107.10.75}"
users="{192.168.4.3 192.168.4.28 192.168.4.59}"
dnsse="{89.239.139.131 89.239.139.130}"
prts="{20 21 25 80 110}"
scrub in all fragment reassemble
scrub out all random-id max-mss 1500
nat on $adsl from $users to any port $prts -> $adsl
pass in quick on {$adsl $zavod} proto {tcp udp} from {$friends $users} to $free port ssh
pass out quick on {$zavod $adsl} proto icmp
pass quick on {$adsl $zavod} proto {tcp udp} from {$free $users} to any port {53 52}
pass out quick on $adsl proto {tcp udp} from $free to any #port {20 21}
block log
fxp0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8<VLAN_MTU>
ether 00:08:c7:85:bd:f5
inet 192.168.4.250 netmask 0xffffff00 broadcast 192.168.4.255
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
dc0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8<VLAN_MTU>
ether 00:a0:cc:5f:60:5e
inet 192.168.1.250 netmask 0xffffff00 broadcast 192.168.1.255
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
но впринципе тут другое дело, как идентичные пакеты могут в одном случае проходить мимо фаера ,а в другом блокироваться
Вариант для распечатки
OpenNET: Виртуальная конференция (Public)
(ok) on 12-Янв-09, 12:55 
