I'd appreciate help here. I disallow iana reserved and some rfc 1918 from my firewall. The line in question is this: cRES_LDROP all -- 172.16.0.0/12 0.0.0.0/0 which I would expect to block 172.16 to 172.31. However I get these in my log files: Jul 18 16:21:47 fw kernel: [FW Drop-Res] IN=eth1 OUT= MAC=<xx> SRC=172.139.140.122 DST=<myip> LEN=48 TOS=0x00 PREC=0x00 TTL=109 ID=30189 DF PROTO=TCP SPT=3477 DPT=1025 WINDOW=16384 RES=0x00 SYN URGP=0 I'm stumped - why did 172.139 get dropped here? Not that the packet wouldn't have gotten dropped later anyway but this rule should not have matched? Suggestions? gene/
