double NOT in rules is not working as expected
Bojidara Marinchovska <[email protected]> Fri, 08 Apr 2011 13:19:59 +0300
| Newsgroups | gmane.os.openbsd.pf |
|---|---|
| Message-ID | <[email protected]> |
Hello,
netif="netif"
test1="1.2.3.4"
test2="2.3.4.5"
block in quick on $netif from {!$test1, !$test2} to x.x.x.x - blocks the
access from the IPs from test1 and test2 macros, BUT it should block all
other EXCEPT this ones
--
block in quick on $netif from {$test1, $test2} to x.x.x.x - this rule
works as expected
--
block in quick on $netif from {!$test1, $test2} to x.x.x.x - this rule
works as expected
--
block in quick on $netif from {$test1, !$test2} to x.x.x.x - this rule
works as expected
I know example rule :
block in quick on $netif from {!$test1, !$test2} to x.x.x.x
can be replaced with:
pass in quick on $netif from {$test1, $test2} to x.x.x.x
block in quick on $netif from any to x.x.x.x
In the example I used macors, also tried with tables or direct inserting
IP addresses instead of using macros or tables, but it does not work as
expected
So it is possible to use {$test, $test1}, but isn't "double negation" as
following: {!$test1, !$test2} ?