Re: prefix len confusion

[Randy Bush <randy@psg.com>]

>     chain wan-in {
>         ip saddr $BOGONS4 drop
>         ip daddr $VULN4 drop
>         ip protocol icmp accept
>         ip saddr $JUMP4 accept
>         ip saddr $EXTv4 accept

i believe that this would drop connections from within the trust bundary
($JUMP4 & EXTv4) to the protected hosts ($VULN4) that the trust boundary
was created to specifically allow.

randy