pf is the OpenBSD Packet Filter, a feature-rich IP-layer firewall used on OpenBSD, FreeBSD and NetBSD, as well as in the pfSense open-source firewall appliance software.

learn more… | top users | synonyms

0
votes
0answers
12 views

Proxy outbound connections throught squid

Informations FreeBSD 10.0 Squid 2.7 PF Scenario All the connections need to pass through an external authenticated proxy, so i need to proxy all outbound ftp and http connections through a ...
1
vote
0answers
26 views

PF Firewall Rules Help - Block IP Hammering

I'm having an issue where someone is using a VPN / proxy to hammer my server. They will pick on random URL from my website and perform ~20 requests per second to it. Once I ban the IP address, a few ...
0
votes
0answers
10 views

pf - redirect rule does not work

I'm using pf on FreeBSD 9. sshd is up and listening on loopback only (127.0.0.1). Trying to use redirect rule to allow network hosts to connect via ssh. set block-policy drop set skip on lo0 scrub ...
0
votes
1answer
19 views

Expanding a macro containing a subnet IP address with prefix (CIDR) in a list using PF firewall

I’m trying to expand a macro that contains an address with a subnet mask into a list with PF like so: subnet1 = "192.168.1.0/24" subnet2 = "10.0.0.0/8" subnets = "{" $subnet1 $subnet2 "}" But this ...
0
votes
0answers
25 views

openbsd pf rdr-to not working

I have multiple IP addresses aliased on my external interface and I am trying to forward from one of those IPs to an internal address for port 80. My (sanitised) config is as follows: set limit ...
0
votes
1answer
90 views

PF firewall frontend

I'm running FreeBSD 9.2 and the PF firewall. I'm looking for an easier/faster way of adding and modifying my PF rules. Preferable a simple web ui. Is there any software like this available? I've ...
1
vote
1answer
340 views

PF Firewall on OSX with IceFloor

I have set up pf using IceFloor on my OSX 10.9 system running Server 3.0.2. Everything seems to be fine except that I can not connect to the system using the DNS name or the public IP from localhost. ...
0
votes
1answer
51 views

FreeBSD pf Egress Filtering

I am attempting to build a simple pf.conf which includes NAT allowing traffic out of the network from all systems on a select series of ports. In my basic configuration I have an internal server that ...
4
votes
1answer
93 views

routing table vs PF precendence

I am wondering when a packet reaches an interface and I have some PF rules, which gets checked first, the routing table or the ruleset? ext_if = "em0" int_if = "em1" localnet = $int_if:network ...
1
vote
1answer
85 views

Limit ftp connections with pf firewall at FreeBSD

I want to limit simultaneous FTP connections to my FreeBSD server with the pf firewall. For example that only 10 simultaneous connection are possible to the port 20 or 21 from one source IP. I use ...
0
votes
1answer
88 views

pf not execute udp port specific block rule

The traffic I want to block can be sniffed as below with tcpdump: 19:16:22.391164 IP 95.95.95.95.2036 > 10.10.10.10.443: UDP, length 8192 So I wanted to write a rule block any udp destination ...
0
votes
0answers
109 views

PF, redirecting SSH to internal VM

I run a FreeBSD server with VirtualBox on it. There's a VM in there I'd like to contact via SSH directly using Port 20000. Client and FreeBSD server are connected through OpenVPN via tun. The ...
1
vote
0answers
776 views

Enabling pf for transparent proxy on Mac OS X Mountain Lion

I'm doing some usability testing of a web application and am attempting to debug and record some SSL sessions using mitmproxy as a transparent proxy and for some reason pf under Mac OS X Mountain Lion ...
2
votes
1answer
124 views

Outline squid server - redirect traffic with pf

What's my goal: know what employee are looking in Internet (what pages, how long etc; no caching). What I did: install squid on openBSD Problem: I see whole traffic (tcpdump), but I can't redirect ...
1
vote
0answers
58 views

Restrict “open” ethernet traffic to OpenVPN Traffic only when on a certain network

I would like to set up a pf or ipfw firewall rule on my Mac OS X 10.8 notebooks so that all Traffic on wireless and cabled networks is restricted to calling "home" through OpenVPN when I'm not in the ...
4
votes
1answer
136 views

pf slows traffic extremely down

I am running a web and mail server on FreeBSD 9.1. The system is installed on a KVM vServer. Everything works fine - until I enable pf(4). My weblog becomes unconscionably slow. So does all the other ...
4
votes
1answer
68 views

pfctl in OpenBSD and FreeBSD

I've noticed that both FreeBSD and NetBSD have extra pfctl options: pfctl [-AdeghmNnOPqRrvz] But OpenBSD doesn't, it's missing around five of the extra options: pfctl [-deghnPqrvz] I would have ...
0
votes
1answer
113 views

How to redirect a packet to localhost in pf?

I am trying to redirect packets that are going to internal network to localhost of firewall. I wrote this rule but it doesn't work. int_net = "{10.0.0.0/24}" ext_if = "{igb0}" int_if = "{igb1}" rdr ...
1
vote
1answer
87 views

How to filter TCP packets based on flags using Packet Filter

Well, I didn't know exactly how to ask this question, but I know that you can use the keyword flags to especify which flags you want to filter. According to the documentation of the Packet filter: ...
0
votes
2answers
141 views

How to run python script which required root privilage for execution in apache with mod_python at openbsd

I am trying to run python script in Apache 2.x with mod_python. I edited httpd.conf with publisher LoadModule python_module /usr/local/apache2/modules/mod_python.so <Directory ...
0
votes
1answer
657 views

freebsd pf squid transparent

I have broken my brain dealing with this. Squid was built from ports /usr/ports/www/squid32 with PF_TP enabled. I have internet but strangely it bypasses squid. Obviously, squid logs are empty. I ...
2
votes
2answers
146 views

Altq/Pf trouble on OpenBSD

I'm having some trouble with pf/altq on OpenBSD but as I'm new to it I'm not sure if its because I'm misunderstanding how to use anchors, or if something is wrong with my system. I'm trying to add ...
2
votes
1answer
283 views

Reasonable rate limiting settings with PF firewall

I have the following settings in my pf.conf to dissuade abusive clients (I get a few a day that are obviously just scraping content indiscriminately and slow everything down): pass in on $ext_if ...
0
votes
1answer
92 views

Passing traffic to a service behind firewall

I am running nginx on port 8080, now I like to make it accessible from the internet, for that I open a port on my Router, next I add some rules to my PF, but a sniff from wireshark I see port ...
1
vote
1answer
166 views

blocking packets for a non established connection on freebsd pf

For a freebsd pf firewall; I want it to block packets for non established connections. For example , the attacker should not send Reset packets for an unknown not-yet-established connection. In Linux ...
0
votes
1answer
178 views

OpenBSD ftp-proxy behind NAT itself

Is it possible to change the PASV IP ftp-proxy of OpenBSD sends to clients, without changing the listen address of redirection control (-b <address>)? I have the following setup: FTP client ...
5
votes
1answer
280 views

Block Google requests to 16k using pf firewall

I'd like to block access to Google search using PF after the threshold of 17500 requests (connection established) in 24h, from a host running FreeBSD 9. What I came up with, after reading pf-faq is ...
2
votes
1answer
842 views

OS X 10.8: redirecting locally initiated ssh connections to localhost:22

I need to hack the OS X pf to redirect all ssh connections from an user to this machine. I want, when doing $ ssh google.com to get the same results as with $ ssh localhost ie a connection to ...
1
vote
1answer
894 views

OpenBSD pf 'match in all scrub (no-df)' causes HTTPS to be unreachable on mobile network

First of all: excuse me for my poor usage of the English language. For several years I'm experiencing problems with the 'match in all scrub (no-df)' rule in pf. I can't find out what's happening ...
-1
votes
2answers
456 views

Route ssh traffic based on hostname using FreeBSD/pf?

I have a proxy/firewall machine running FreeBSD 9, using PF to route and filter traffic as needed. Now I'm setting up a git server, which runs over ssh, but I'm already using port 22 for ssh. I would ...
5
votes
2answers
988 views

Can I create a pf rule involving MAC address instead of IP?

The title is self explanatory. I want to create rules in pf running on OpenBSD 4.9 for perticular MAC address, something like pass in on eth0 from mac 00:04:34:5f:34:33 to mac 34:32:34:06:5e:22 I ...
3
votes
2answers
2k views

Create a rule using shell in fresh pfSense installation to open up WAN access to WebConfigurator

I am in a situation where I require WAN access to be opened up to the WebConfigurator through pfSense because I do not have another node connected to the same network to access WebConfigurator from ...
2
votes
1answer
481 views

OpenBSD pf - implementing the equivalent of an iptables DNAT

Short version Server A (OpenBSD 4.7) connects to server B (Windows). IP of server B changes. Server A should be able to connect to server B to both the old and new IP. We cannot configure multiple ...
0
votes
1answer
543 views

pfSense to ASA L2L VPN - infrequent, short-lasting, but consistent disconnections

Has anyone here been able to specify a stable configuration for the L2L VPN between an ASA device and pfSense 2.0.1? I am using the most accomodating settings on the ASA side (DefaultL2LGroup with ...
2
votes
1answer
219 views

FreeBSD - monitor aggregate bandwidth of individual local network devices

I'm looking for ways to monitor the Internet usage - the total amount of data transferred - of individual devices on my network. I'm using FreeBSD 9.0-RELEASE with pf for filtering and NAT. I'm not ...
0
votes
1answer
669 views

Bypassing SQUID on freebsd with PF

I have PF+SQUID31 on FREEBSD-9.0, and I want to have some hosts(aka goodguys) to bypass the proxy, so that torrents are not logged. Also, I am not sure about transparent. It means that I dont have to ...
0
votes
1answer
385 views

OpenBsd 5 port forwarding

I'm trying to configure pf port forwarding on OpenBSD 5.0 The firewall machine has two nics: em0: 192.168.200.3 vic0: 192.65.214.136 I would like to forward all packets comming into ...
2
votes
2answers
185 views

How to configure something like “Reflexive ACL” on OpenBSD?

My U-Verse modem has something called "Reflexive ACL" described as Reflexive ACL: When IPv6 is enabled, you can enable Reflexive Access Control Lists to deny inbound IPv6 traffic unless this ...
0
votes
1answer
542 views

Order of application of NAT rules in pfSense 2

In pfSense 2.0, I have a bunch of WAN CARP Virtual IPs and a bunch of 1:1 NAT rules defined associating these IPs to LAN subnet hosts. If I set up Port Forwarding rules that forward from CARP IPs ...
0
votes
1answer
3k views

OpenBSD 5.0 pf with NAT & Port Forwarding

Port forwarding does not seem to work properly, incoming connections apparently are blocked. Is there something wrong with my pf.conf? # Performance limits set limit states 200000 set limit ...
2
votes
0answers
156 views

Is there an equivalent of LinuxIMQs in BSD?

Is there an equivalent of LinuxIMQs in BSD ? From linuximq.net: The imq device has two common usage cases: Ingress shaping: With linux only egress shaping is possible (except for the ingress ...
1
vote
3answers
913 views

Port-Forward for all IPs on an interface

I'm running a java-based web server as a non-privileged user. Therefore it listens on ports 8080 and 8443 instead of 80 and 443. Right now I'm using the following pf rules to forward the ports ...
2
votes
2answers
375 views

Default values of pf.conf set parameters

I want to learn default values of these parameters, I read the manual of pf.conf but couldn't find, could you help? set limit states set limit src-nodes set timeout tcp.first set timeout ...
0
votes
2answers
1k views

Slow upload speeds with pfsense virtual appliance

I have a pfSense virtual appliance set up in front of a Windows server. The pfSense appliance has been configured with two L2L IPSec VPN sites and not too much else. The appliance has two vNics which ...
2
votes
1answer
819 views

Getting per-ip traffic stats from PF

Is there a way to get per-ip traffic stats from PF on OpenBSD 4.9? pfctl can give me the total traffic (bytes) for a given label, and pfstats for a given interface, and pftop can give me a "live" view ...
4
votes
1answer
793 views

OpenBSD pf port forwarding multiple rules

I have a few dozen servers behind OpenBSD firewall with port forwarding. Most rules are very similar and differ only in IPs or sometimes in ports forwarded, so I want to compact them to remove ...
0
votes
2answers
54 views

Keep connection state with target machine in PF when reply comes from a different IP

I'm facing a challenge with my PF firewall on an OpenBSD machine. From a client (A) I'm connecting to a server (B) using a target ip (SRV-IP-1). The server is replying to my request, but sourcing the ...
7
votes
3answers
1k views

OpenBSD/FreeBSD Firewall w/ GUI that is compatible with Intel 82574L Gigabit LAN NICs

I recently purchased a server to run m0n0wall or pfSense but I've learned since then that both of these firewall products are based on versions of FreeBSD which weren't yet compatible with the NICs in ...
2
votes
1answer
632 views

How to check pf's queues?

I use FreeBSD and working with pf+ALTQ now. Something doesn't work and I need a tool to view what requests are marked and moved to a queue "queue_name" Need something like pftop but showing queues. ...
0
votes
2answers
1k views

PF rules and configuration to allow a local IP alias to NAT on FreeBSD?

Here's exact details of my configuration: Firewall/DNS Server: 192.168.2.1 (local lan) which routes out to the internet. <-- NOT UNDER MY CONTROL My FreeBSD Server: 192.168.2.23 (LAN) "Inside" ...