Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm currently using IPFW on 3 dedicated firewall servers, and I would like to convert them to PF for some of its functionalities, but I need divert to work. Specifically I am teeing packets to a custom application for network analysis purposes.

Is it (or something similar) supported in PF?

share|improve this question
    
maybe using port mirroring on your switch is an option? –  The Unix Janitor Mar 23 '10 at 10:30
add comment

3 Answers 3

up vote 2 down vote accepted

No, in OpenBSD v4.6 version, PF has no divert-like feature.

But good news, divert for PF will be included in OpenBSD v4.7 version

See http://www.mail-archive.com/source-changes@openbsd.org/msg11694.html for details. You could try it with OpenBSD-current branch / snapshots.

share|improve this answer
    
Great news thanks! –  Massimiliano Torromeo Jan 11 '10 at 11:13
add comment

pf does have a command called 'divert-to' that is supposed to provide for local transparent routing. See the pf.conf man page for slightly more details. It appears to be simple but it doesn't seem to want to do what I want it to do: local capture and redirection to a local port of outbound traffic which is locally generated.

Other similar commands which I have tried but to no avail are: 'rdr' which instructs a packet to have a new destination, overwriting the old one... useful for destination nat type applications. 'route-to' which instructs a packet to pass through another location before arriving at its original destination... doesn't accept a port, useful for routers, not so much for proxies.

share|improve this answer
add comment

If I remember correctly: PF has a special interface for monitoring purposes (pflog). You might wanna consult the manpage for it.

share|improve this answer
1  
Correct you would log the and then use tcpdump or what have you to grab the packet. Details here: openbsd.org/faq/pf/logging.html Example: pass in log (all, to pflog1) on $ext_if inet proto tcp to $ext_if port 22 keep state –  Jeremy Rossi Nov 30 '09 at 20:34
    
Thanks, that's interesting but I would still like to know if there's something more divert-like. –  Massimiliano Torromeo Nov 30 '09 at 20:42
    
pf has a "rdr" option, tried looking into that? The PF manual (at openbsd.org) is very good, try it. –  pauska Nov 30 '09 at 21:57
    
openbsd.org/faq/pf/logging.html may be useful –  SaveTheRbtz Dec 1 '09 at 19:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.