# PF how ports are "connected" in rule?



## jahlives (Jul 12, 2012)

Hello forum

I know it's not a specific FreeBSD question but more a general question about PF firewall. Still hope someone can light up my darkness a bit 

In PF multiple ports can be given in a rule like this

```
pass in quick on $ext proto tcp from any to any port { 25 53 587 }
```
so in the case above the ports are imho "connected" by a logical OR
But what will happen in the following case where I try to negate the ports?

```
block in quick on $ext proto tcp from any to any port ! { 25 53 587 }
```
how are the ports evaluated in this case? imho the ports should be "connected" with logical AND. Is this the case?

Thanks for any light 

tobi


----------



## SirDice (Jul 12, 2012)

They are simply expanded into three rules.


```
pass in quick on $ext proto tcp from any to any port { 25 53 587 }
```
Will become:

```
pass in quick on $ext proto tcp from any to any port 25
pass in quick on $ext proto tcp from any to any port 53
pass in quick on $ext proto tcp from any to any port 587
```

You can see this when you do `# pfctl -s rules`


----------



## suntzu (Jul 12, 2012)

Why don't you do the test yourself?


----------

