pf is the OpenBSD Packet Filter, a feature-rich IP-layer firewall used on FreeBSD, NetBSD, and Mac OS X, as well as in the pfSense open-source firewall appliance software.

learn more… | top users | synonyms

-2
votes
0answers
18 views

transparent squid 3.5 + pf on freebsd 10.1

I'm having trouble with pf rule redirect http traffic to squid version 3.5.4 on FreeBSD 10.1. I set up squid like a transparent proxy, now I have pf and I want redirect every http connect to squid but ...
0
votes
0answers
49 views

pf.conf DNS dual redirect to dnscrypt-proxy. Just need confirmation my code is correct

I have 2 isolated LANS on my gateway. They are blocked from communicating to one another in pf by: block in log on $int_if from "192.168.1.0/25" to "192.168.1.128/25" block in log on $int_if from ...
3
votes
1answer
59 views

PF vs -m of iptables

As you know, iptables has -m (match) such as : -m string -m state -m -iplimit and so on... My question: Does PF has similar features such as -m of iptables?
0
votes
0answers
12 views

FreeBSD pf does not allow inbound smtp [duplicate]

I'm trying to figure out why the following simple pf config allows inbound SSH but not smtp (tcp 25). I'm running FreeBSD 10.1-RELEASE-p9, and the SMTP server is postfix 2.11.4. # ...
1
vote
1answer
154 views

openbsd pf squid transparent proxy using a bridge

I want to use OpenBSD 5.7 as a filtering bridge in front of my router, and as part of that run a transparent proxy (squid 3.5.1) to manage web access. I have set up the openbsd machine as a bridge, ...
1
vote
1answer
59 views

FreeBSD pf with NFS

I'm having trouble establishing new NFS connections when my pf is turned on. When I turn off pf on the server and client I'm able to mount with no trouble. I tried keep state and flags S/SA on the ...
2
votes
0answers
62 views

How to divert all OUTBOUND tcp traffic on port 1935 to localhost?

Mac OS X 10.10.3. I'm trying to use rtmpsrv. In order to do that, I have to redirect all outgoing tcp traffic on port 1935 to localhost. I tried: sudo sysctl -w net.inet.ip.forwarding=1 echo 'rdr ...
2
votes
3answers
283 views

How can one redirect to a new host all traffic destined for an old host?

We're moving a bunch of services, say from 1.2.3.4 to 5.6.7.8. In order to test that the new services are correctly configured, we'd like to redirect (to the new host) all traffic destined for the ...
1
vote
2answers
221 views

How to block MAC address in pf firewall

I want to block particular MAC address on PF firewall. I know PF firewall works on the Layer 3 i.e it operates on the IP addresses rather than MAC address.But is there any way to block the MAC address ...
0
votes
0answers
43 views

How to manage overload of ICMP with PF?

I would like to make a basic managment of ICMP overload with packet filter on FreeBSD. The function I would like to realise is:     if target receive too many ICMP from a given source IP address,   ...
2
votes
1answer
96 views

OpenBSD cannot set frag limit more than 6144

I am trying to : set limit frags 10000 and get following info: pfctl: cannot set 'frags' limit When i am trying to set it on 5000 everything works fine.
0
votes
1answer
118 views

Forwarding IP address using pf

I'm trying to forward an external IP address to another external IP address with pf. The equivalent iptables command would be iptables -t nat -A OUTPUT -d [ipaddress1] -j DNAT --to-destination ...
2
votes
1answer
76 views

PF redirect rule: how to limit the rule to specific user

I was trying to setup a PF redirect rule to force all web traffic from a specific user account to go through a web filter on a shared computer. With iptables, I can use --uid-owner option to limit ...
1
vote
1answer
123 views

Local transparent proxy OS X pf

I was trying to create local transparent proxy using this pf rules: rdr pass inet proto tcp from $Out to any port 80 -> 127.0.0.1 port 3129 pass out on $Out route-to lo0 inet proto tcp from $Out ...
1
vote
0answers
48 views

PF rule for Continuity

So it looks like the Continuity on OS X 10.10 creates network interface on the fly (utun2 here) and my PF blocks it, so that I can't make/answer calls. I'm not an admin, just use the IceFloor for PF ...
0
votes
1answer
942 views

using pf for packet filtering and ipfw's dummynet for bandwidth limiting at the same time

I would like to ask if it's fine to use pf for all packet filtering (including using altq for traffic shaping) and ipfw's dummynet for bandwidth limiting certain IPs or subnets at the same time. I am ...
0
votes
1answer
845 views

port forwarding with pf on Mac OS 10.9

I have to setup a port forwarding on Mac Os 10.9. The mac is connected to a OpenVPN, and I need to get access to another machine on the private network of the mac through that VPN. Apparently, Mac OS ...
0
votes
0answers
41 views

Will pfctl -sr show ordered rules when using -o profile?

When I enable the -o profile option with pf will pfctl -sr show me the new order of the rules?
1
vote
1answer
214 views

Command to set dscp / ToS value on outgoing packets for OS X Mavericks?

I want to set a certain DSCP (or ToS) value on all packets sent over port 22. I have an iptables command to do so, but Mavericks only has the equivalent of pfctl and I can't figure out how to ...
0
votes
0answers
59 views

FreeBSD - How can I let server A get web access via server B over a specific port?

Setup: Server A: FreeBSD 10 - IP: 100.100.100.100 Server B: FreeBSD 9 - IP: 200.200.200.200 Both servers use pf.conf. Desired result: I want server A to be able to get web access (port 80) via ...
1
vote
1answer
87 views

Mac OS X Firewall isn't firewalling

Rather confused by the results I'm getting on a Mac OS X Server running 10.8. I have an app that is running a web server on port 8000, which I want to be visible only to localhost. This seems ...
0
votes
1answer
362 views

correctly setup PF with loopback interfaces for nginx proxy

I am trying to run couple of freebsd jails for my web server and application server, which is running node.js I have one network card (igb0) with a custom loopback interface (lo666) for which i have ...
1
vote
1answer
813 views

PF: Block all, but one subnet firewall rule?

I'm trying to do something that I thought would be relatively simple: Block all the traffic to a test server, other than my company's subnet. I've tried things along these lines (111.111.0.0 is my ...
1
vote
0answers
85 views

PF Firewall Rules Help - Block IP Hammering

I'm having an issue where someone is using a VPN / proxy to hammer my server. They will pick on random URL from my website and perform ~20 requests per second to it. Once I ban the IP address, a few ...
0
votes
1answer
551 views

pf - redirect rule does not work

I'm using pf on FreeBSD 9. sshd is up and listening on loopback only (127.0.0.1). Trying to use redirect rule to allow network hosts to connect via ssh. set block-policy drop set skip on lo0 scrub ...
0
votes
1answer
114 views

Expanding a macro containing a subnet IP address with prefix (CIDR) in a list using PF firewall

I’m trying to expand a macro that contains an address with a subnet mask into a list with PF like so: subnet1 = "192.168.1.0/24" subnet2 = "10.0.0.0/8" subnets = "{" $subnet1 $subnet2 "}" But this ...
0
votes
1answer
366 views

PF firewall frontend

I'm running FreeBSD 9.2 and the PF firewall. I'm looking for an easier/faster way of adding and modifying my PF rules. Preferable a simple web ui. Is there any software like this available? I've ...
3
votes
1answer
3k views

PF Firewall on OSX with IceFloor

I have set up pf using IceFloor on my OSX 10.9 system running Server 3.0.2. Everything seems to be fine except that I can not connect to the system using the DNS name or the public IP from localhost. ...
0
votes
1answer
292 views

FreeBSD pf Egress Filtering

I am attempting to build a simple pf.conf which includes NAT allowing traffic out of the network from all systems on a select series of ports. In my basic configuration I have an internal server that ...
4
votes
1answer
197 views

routing table vs PF precendence

I am wondering when a packet reaches an interface and I have some PF rules, which gets checked first, the routing table or the ruleset? ext_if = "em0" int_if = "em1" localnet = $int_if:network ...
1
vote
1answer
207 views

Limit ftp connections with pf firewall at FreeBSD

I want to limit simultaneous FTP connections to my FreeBSD server with the pf firewall. For example that only 10 simultaneous connection are possible to the port 20 or 21 from one source IP. I use ...
0
votes
1answer
358 views

pf not execute udp port specific block rule

The traffic I want to block can be sniffed as below with tcpdump: 19:16:22.391164 IP 95.95.95.95.2036 > 10.10.10.10.443: UDP, length 8192 So I wanted to write a rule block any udp destination ...
0
votes
0answers
341 views

PF, redirecting SSH to internal VM

I run a FreeBSD server with VirtualBox on it. There's a VM in there I'd like to contact via SSH directly using Port 20000. Client and FreeBSD server are connected through OpenVPN via tun. The ...
2
votes
1answer
3k views

Enabling pf for transparent proxy on Mac OS X Mountain Lion

I'm doing some usability testing of a web application and am attempting to debug and record some SSL sessions using mitmproxy as a transparent proxy and for some reason pf under Mac OS X Mountain Lion ...
2
votes
1answer
317 views

Outline squid server - redirect traffic with pf

What's my goal: know what employee are looking in Internet (what pages, how long etc; no caching). What I did: install squid on openBSD Problem: I see whole traffic (tcpdump), but I can't redirect ...
1
vote
0answers
76 views

Restrict “open” ethernet traffic to OpenVPN Traffic only when on a certain network

I would like to set up a pf or ipfw firewall rule on my Mac OS X 10.8 notebooks so that all Traffic on wireless and cabled networks is restricted to calling "home" through OpenVPN when I'm not in the ...
4
votes
1answer
656 views

pf slows traffic extremely down

I am running a web and mail server on FreeBSD 9.1. The system is installed on a KVM vServer. Everything works fine - until I enable pf(4). My weblog becomes unconscionably slow. So does all the other ...
4
votes
1answer
91 views

pfctl in OpenBSD and FreeBSD

I've noticed that both FreeBSD and NetBSD have extra pfctl options: pfctl [-AdeghmNnOPqRrvz] But OpenBSD doesn't, it's missing around five of the extra options: pfctl [-deghnPqrvz] I would have ...
0
votes
1answer
398 views

How to redirect a packet to localhost in pf?

I am trying to redirect packets that are going to internal network to localhost of firewall. I wrote this rule but it doesn't work. int_net = "{10.0.0.0/24}" ext_if = "{igb0}" int_if = "{igb1}" rdr ...
1
vote
1answer
166 views

How to filter TCP packets based on flags using Packet Filter

Well, I didn't know exactly how to ask this question, but I know that you can use the keyword flags to especify which flags you want to filter. According to the documentation of the Packet filter: ...
0
votes
2answers
424 views

How to run python script which required root privilage for execution in apache with mod_python at openbsd

I am trying to run python script in Apache 2.x with mod_python. I edited httpd.conf with publisher LoadModule python_module /usr/local/apache2/modules/mod_python.so <Directory ...
0
votes
1answer
2k views

freebsd pf squid transparent

I have broken my brain dealing with this. Squid was built from ports /usr/ports/www/squid32 with PF_TP enabled. I have internet but strangely it bypasses squid. Obviously, squid logs are empty. I ...
3
votes
2answers
275 views

Altq/Pf trouble on OpenBSD

I'm having some trouble with pf/altq on OpenBSD but as I'm new to it I'm not sure if its because I'm misunderstanding how to use anchors, or if something is wrong with my system. I'm trying to add ...
2
votes
1answer
594 views

Reasonable rate limiting settings with PF firewall

I have the following settings in my pf.conf to dissuade abusive clients (I get a few a day that are obviously just scraping content indiscriminately and slow everything down): pass in on $ext_if ...
0
votes
1answer
152 views

Passing traffic to a service behind firewall

I am running nginx on port 8080, now I like to make it accessible from the internet, for that I open a port on my Router, next I add some rules to my PF, but a sniff from wireshark I see port ...
1
vote
1answer
355 views

blocking packets for a non established connection on freebsd pf

For a freebsd pf firewall; I want it to block packets for non established connections. For example , the attacker should not send Reset packets for an unknown not-yet-established connection. In Linux ...
0
votes
1answer
284 views

OpenBSD ftp-proxy behind NAT itself

Is it possible to change the PASV IP ftp-proxy of OpenBSD sends to clients, without changing the listen address of redirection control (-b <address>)? I have the following setup: FTP client ...
5
votes
1answer
467 views

Block Google requests to 16k using pf firewall

I'd like to block access to Google search using PF after the threshold of 17500 requests (connection established) in 24h, from a host running FreeBSD 9. What I came up with, after reading pf-faq is ...
2
votes
1answer
2k views

OS X 10.8: redirecting locally initiated ssh connections to localhost:22

I need to hack the OS X pf to redirect all ssh connections from an user to this machine. I want, when doing $ ssh google.com to get the same results as with $ ssh localhost ie a connection to ...
1
vote
2answers
2k views

OpenBSD pf 'match in all scrub (no-df)' causes HTTPS to be unreachable on mobile network

First of all: excuse me for my poor usage of the English language. For several years I'm experiencing problems with the 'match in all scrub (no-df)' rule in pf. I can't find out what's happening ...