Re: prefix len confusion

Randy Bush <[email protected]> Wed, 10 Jun 2026 16:57:19 -0700

Newsgroups	gmane.comp.security.firewalls.netfilter.general
Message-ID	<[email protected]>

>     chain wan-in {
>         ip saddr $BOGONS4 drop
>         ip daddr $VULN4 drop
>         ip protocol icmp accept
>         ip saddr $JUMP4 accept
>         ip saddr $EXTv4 accept

i believe that this would drop connections from within the trust bundary
($JUMP4 & EXTv4) to the protected hosts ($VULN4) that the trust boundary
was created to specifically allow.

randy