Re: prefix len confusion

Randy Bush <[email protected]> Wed, 10 Jun 2026 17:25:08 -0700

Newsgroups	gmane.comp.security.firewalls.netfilter.general
Message-ID	<[email protected]>

>      chain wan-in {
>          ip saddr $BOGONS4 drop
>          ip saddr $EXTv4 daddr $VULN4 accept
>          ip saddr $JUMP4 daddr $VULN4 accept
>          ip daddr $VULN4 drop
>          ip protocol icmp accept
> ...
> 
> Did you mean to do this instead?

not really.  if the source is in the trust boundary, it can access
anything.  e.g. there was also a

           tcp dport 8006 ip daddr $PROX4 drop

in there which is yet more dests allowed to trusted sources

randy