I was trying to put a rule for catching all out-of-state packets so that the Default Deny rule really and only lists/blocks illegitimate traffic. Put that rule also into the floating section right above the default Deny rule. After some testing I get the impression, that the non-quick rules get evaluated in reverse order (compared to how they appear in the list). Hence, if I place the Out-Of-State rule BEHIND the Default Deny rule, the Out-of-State will be sorted out and Default Deny is left for just the illegitimate traffic.
Can somebody confirm, this is by design? Thanks.
And: thanks for this great piece of software!
Quotenon-quick rules get evaluated in reverse order (compared to how they appear in the list)
(if i understand this sentence right) that's how pf works: for non-quick rules last matching rule wins.
or, to put it another way: in pf the last matching rule wins, and setting the 'quick' option makes the matched rule last