Re: prefix len confusion

[Randy Bush <randy@psg.com>]

>      chain wan-in {
>          ip saddr $BOGONS4 drop
>          ip saddr $EXTv4 daddr $VULN4 accept
>          ip saddr $JUMP4 daddr $VULN4 accept
>          ip daddr $VULN4 drop
>          ip protocol icmp accept
> ...
> 
> Did you mean to do this instead?

not really.  if the source is in the trust boundary, it can access
anything.  e.g. there was also a

           tcp dport 8006 ip daddr $PROX4 drop

in there which is yet more dests allowed to trusted sources

randy