Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have been running a pf based filtering router on OpenBSD 4.3 for about a year now. My current task is to set up a new network segment for hosting our external sites.

My aim is that machines set up in this network segment should not have any more access to the rest of our network than a machine on the internet.

On the whole, this is quite close. We have the DNS server returning its external view to this network segment. The pf is not routing traffic from this segment to any segment other than the internet interface. However i cannot seem to prevent it from routing packets to the router, if they are also allowed to go to the internet.

e.g.

block in
...
#  tag dmz traffic as only allowed to internet
pass in on $dmz_if inet all tag INTERNET_ONLY
...
# Ensure only traffic allowed to Internet is passed
block out on $internet_if
block out on $internet_if tagged INTERNET_ONLY tag ROUTE_INTERNET
pass out on $internet_if tagged ROUTE_INTERNET

I would like to be able to add

block out on $local_if from $(dmz_if:network)

to block any packets form going the router, but it appears that packets for the local host do not go out on lo0. How can i block them?

Have I misunderstood how this all works? is there an option that i have missed to allow this?

any suggestions?

share|improve this question
    
I suggest you to upgrade (even if it isn't related). 4.3 is 16 months old and isn't supported anymore since several months. The newer versions fix some security issues and have a lot of shiny great features... –  Benoit Aug 18 '09 at 12:52
    
I appreciate the sentiment, expecially about the security issues, but the thought of re-installing this server is less appealing than root canal work with no anasthetic... So, i'd have to have a solid specific reason that required me to do it that could not be updated in isolation –  Ptolemy Aug 18 '09 at 13:03
add comment

2 Answers

lo0 is local trafic from your router to your router. Like when you use IP 127.0.0.1 to connect.
If you want to prevent your DMZ to talk to connect to your router you need to block in on $dmz_if to your router IPs

share|improve this answer
    
Thanks, this has pushed me in a direction that has greatly improved my understanding. My previous model for this was that the packet filter was run once, scanning packets and controlling their routing. Its not. Its run once with the packet marked as in and then again with the packet marked as out. This affects the rules greatly. When I have the solution finalised I'll add it as the answer, but thanks for giving me the crucial shove in the right direction. –  Ptolemy Aug 18 '09 at 13:54
    
Yes, pf is run on each interface for both in and out (if you make rules for every interface in both direction). I would recommand to filter the inside trafic on all interface. Mixing in and out can be a nightmare to maintain. –  radius Aug 18 '09 at 14:46
add comment
up vote 0 down vote accepted

This has now solved my problem, and is tested.

# record your internal IP addresses
internal_ip_addr="{" $dmz_if:0 "," $office_if:0 "," $pms-servers_if:0 "}"

block in
...
#  tag dmz traffic as only allowed to internet
pass in on $dmz_if inet all tag INTERNET_ONLY
...
# Ensure only traffic allowed to Internet is passed
block out on $internet_if
block out on $internet_if tagged INTERNET_ONLY tag ROUTE_INTERNET
pass out on $internet_if tagged ROUTE_INTERNET
...
# block traffic directed at my internal ip addresses.
block in on $dmz_if from any to $internal_ip_addr

The "user model" for this is to consider the computer with a series of interfaces for each network connection, (inc local, encrypted etc..) and the packet filter is applied each time a packet passes accross an interface. If you tag a packet, that tag remains with the packet when it is filtered on the out interface.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.