pf is the OpenBSD Packet Filter, a feature-rich IP-layer firewall used on OpenBSD, FreeBSD and NetBSD, as well as in the pfSense open-source firewall appliance software.
0
votes
1answer
27 views
How to redirect a packet to localhost in pf?
I am trying to redirect packets that are going to internal network to localhost of firewall.
I wrote this rule but it doesn't work.
int_net = "{10.0.0.0/24}"
ext_if = "{igb0}"
int_if = "{igb1}"
rdr ...
1
vote
1answer
44 views
How to filter TCP packets based on flags using Packet Filter
Well, I didn't know exactly how to ask this question, but I know that you can use the keyword flags to especify which flags you want to filter.
According to the documentation of the Packet filter:
...
0
votes
1answer
36 views
How to run python script which required root privilage for execution in apache with mod_python at openbsd
I am trying to run python script in Apache 2.x with mod_python.
I edited httpd.conf with publisher
LoadModule python_module /usr/local/apache2/modules/mod_python.so
<Directory ...
-2
votes
1answer
48 views
freebsd pf.conf [closed]
Please, give me an advice of how to build firewall filter rules for PF in FreeBSD.
There are many tutorials, however they are all different from each other, and I don't really have a clue how to do ...
0
votes
1answer
113 views
freebsd pf squid transparent
I have broken my brain dealing with this.
Squid was built from ports /usr/ports/www/squid32 with PF_TP enabled.
I have internet but strangely it bypasses squid. Obviously, squid logs are empty.
I ...
0
votes
1answer
60 views
Altq/Pf trouble on OpenBSD
I'm having some trouble with pf/altq on OpenBSD but as I'm new to it I'm not sure if its because I'm misunderstanding how to use anchors, or if something is wrong with my system.
I'm trying to add ...
2
votes
1answer
108 views
Reasonable rate limiting settings with PF firewall
I have the following settings in my pf.conf to dissuade abusive clients (I get a few a day that are obviously just scraping content indiscriminately and slow everything down):
pass in on $ext_if ...
0
votes
1answer
69 views
Harvest netblocks of good MTAs from SPF for whitelisting [closed]
I'm configuring greylisting, and one of the things I would like to do is explicitly whitelist good MTAs of e.g. google.com, ebay.com, schwab.com, freebsd.org, uwaterloo.ca etc.
It seems like with the ...
0
votes
1answer
62 views
Passing traffic to a service behind firewall
I am running nginx on port 8080, now I like to make it accessible from the internet, for that I open a port on my Router, next I add some rules to my PF, but a sniff from wireshark I see port ...
1
vote
1answer
63 views
blocking packets for a non established connection on freebsd pf
For a freebsd pf firewall; I want it to block packets for non established connections. For example , the attacker should not send Reset packets for an unknown not-yet-established connection.
In Linux ...
0
votes
1answer
105 views
OpenBSD ftp-proxy behind NAT itself
Is it possible to change the PASV IP ftp-proxy of OpenBSD sends to clients, without changing the listen address of redirection control (-b <address>)?
I have the following setup:
FTP client ...
5
votes
1answer
189 views
Block Google requests to 16k using pf firewall
I'd like to block access to Google search using PF after the threshold of 17500 requests (connection established) in 24h, from a host running FreeBSD 9.
What I came up with, after reading pf-faq is ...
2
votes
1answer
313 views
OS X 10.8: redirecting locally initiated ssh connections to localhost:22
I need to hack the OS X pf to redirect all ssh connections from an user to this machine. I want, when doing
$ ssh google.com
to get the same results as with
$ ssh localhost
ie a connection to ...
1
vote
0answers
66 views
freebsd network packet error
I have included netstat output on freebsd 8.0. Ierrs:944998977. pf works on a single core for all session table operations and under a dos flood attack it uses that core %100.
What I want to learn ...
2
votes
1answer
537 views
OpenBSD pf 'match in all scrub (no-df)' causes HTTPS to be unreachable on mobile network
First of all: excuse me for my poor usage of the English language.
For several years I'm experiencing problems with the 'match in all scrub (no-df)' rule in pf. I can't find out what's happening ...
-1
votes
2answers
283 views
Route ssh traffic based on hostname using FreeBSD/pf?
I have a proxy/firewall machine running FreeBSD 9, using PF to route and filter traffic as needed.
Now I'm setting up a git server, which runs over ssh, but I'm already using port 22 for ssh. I would ...
4
votes
2answers
582 views
Can I create a pf rule involving MAC address instead of IP?
The title is self explanatory.
I want to create rules in pf running on OpenBSD 4.9 for perticular MAC address, something like
pass in on eth0 from mac 00:04:34:5f:34:33 to mac 34:32:34:06:5e:22
I ...
3
votes
2answers
1k views
Create a rule using shell in fresh pfSense installation to open up WAN access to WebConfigurator
I am in a situation where I require WAN access to be opened up to the WebConfigurator through pfSense because I do not have another node connected to the same network to access WebConfigurator from ...
2
votes
1answer
276 views
OpenBSD pf - implementing the equivalent of an iptables DNAT
Short version
Server A (OpenBSD 4.7) connects to server B (Windows). IP of server B changes. Server A should be able to connect to server B to both the old and new IP. We cannot configure multiple ...
0
votes
1answer
305 views
pfSense to ASA L2L VPN - infrequent, short-lasting, but consistent disconnections
Has anyone here been able to specify a stable configuration for the L2L VPN between an ASA device and pfSense 2.0.1? I am using the most accomodating settings on the ASA side (DefaultL2LGroup with ...
2
votes
1answer
164 views
FreeBSD - monitor aggregate bandwidth of individual local network devices
I'm looking for ways to monitor the Internet usage - the total amount of data transferred - of individual devices on my network. I'm using FreeBSD 9.0-RELEASE with pf for filtering and NAT. I'm not ...
0
votes
1answer
540 views
Bypassing SQUID on freebsd with PF
I have PF+SQUID31 on FREEBSD-9.0, and I want to have some hosts(aka goodguys) to bypass the proxy, so that torrents are not logged.
Also, I am not sure about transparent. It means that I dont have to ...
0
votes
1answer
285 views
OpenBsd 5 port forwarding
I'm trying to configure pf port forwarding on OpenBSD 5.0
The firewall machine has two nics:
em0: 192.168.200.3
vic0: 192.65.214.136
I would like to forward all packets comming into ...
2
votes
2answers
153 views
How to configure something like “Reflexive ACL” on OpenBSD?
My U-Verse modem has something called "Reflexive ACL" described as
Reflexive ACL: When IPv6 is enabled, you can enable Reflexive Access
Control Lists to deny inbound IPv6 traffic unless this ...
0
votes
1answer
417 views
Order of application of NAT rules in pfSense 2
In pfSense 2.0, I have a bunch of WAN CARP Virtual IPs and a bunch of 1:1 NAT rules defined associating these IPs to LAN subnet hosts.
If I set up Port Forwarding rules that forward from CARP IPs ...
0
votes
1answer
2k views
OpenBSD 5.0 pf with NAT & Port Forwarding
Port forwarding does not seem to work properly, incoming connections apparently are blocked.
Is there something wrong with my pf.conf?
# Performance limits
set limit states 200000
set limit ...
2
votes
0answers
130 views
Is there an equivalent of LinuxIMQs in BSD?
Is there an equivalent of LinuxIMQs in BSD ?
From linuximq.net:
The imq device has two common usage cases:
Ingress shaping:
With linux only egress shaping is possible (except for the ingress ...
1
vote
3answers
605 views
Port-Forward for all IPs on an interface
I'm running a java-based web server as a non-privileged user. Therefore it listens on ports 8080 and 8443 instead of 80 and 443.
Right now I'm using the following pf rules to forward the ports ...
2
votes
2answers
226 views
Default values of pf.conf set parameters
I want to learn default values of these parameters, I read the manual of pf.conf but couldn't find, could you help?
set limit states
set limit src-nodes
set timeout tcp.first
set timeout ...
0
votes
2answers
834 views
Slow upload speeds with pfsense virtual appliance
I have a pfSense virtual appliance set up in front of a Windows server. The pfSense appliance has been configured with two L2L IPSec VPN sites and not too much else. The appliance has two vNics which ...
2
votes
1answer
608 views
Getting per-ip traffic stats from PF
Is there a way to get per-ip traffic stats from PF on OpenBSD 4.9? pfctl can give me the total traffic (bytes) for a given label, and pfstats for a given interface, and pftop can give me a "live" view ...
4
votes
1answer
632 views
OpenBSD pf port forwarding multiple rules
I have a few dozen servers behind OpenBSD firewall with port forwarding. Most rules are very similar and differ only in IPs or sometimes in ports forwarded, so I want to compact them to remove ...
0
votes
2answers
39 views
Keep connection state with target machine in PF when reply comes from a different IP
I'm facing a challenge with my PF firewall on an OpenBSD machine.
From a client (A) I'm connecting to a server (B) using a target ip (SRV-IP-1).
The server is replying to my request, but sourcing the ...
6
votes
3answers
758 views
OpenBSD/FreeBSD Firewall w/ GUI that is compatible with Intel 82574L Gigabit LAN NICs
I recently purchased a server to run m0n0wall or pfSense but I've learned since then that both of these firewall products are based on versions of FreeBSD which weren't yet compatible with the NICs in ...
2
votes
1answer
420 views
How to check pf's queues?
I use FreeBSD and working with pf+ALTQ now.
Something doesn't work and I need a tool to view what requests are marked and moved to a queue "queue_name"
Need something like pftop but showing queues. ...
0
votes
2answers
980 views
PF rules and configuration to allow a local IP alias to NAT on FreeBSD?
Here's exact details of my configuration:
Firewall/DNS Server: 192.168.2.1 (local lan) which routes out to the internet. <-- NOT UNDER MY CONTROL
My FreeBSD Server: 192.168.2.23 (LAN)
"Inside" ...
0
votes
2answers
145 views
using “include” like statement in pf.conf to include some parts from other files
I want to be able to include some parts of my pf.conf from other set of files.
For example I will include "set timeout" vs like statements in another file.
Using anchors and "load anchor from ...
3
votes
1answer
87 views
blocking packets larger then specific size with pf
Is there a way with pf to block specific type of packets larger than specific size?
3
votes
1answer
693 views
Provide IPv6 to network from OpenBSD firewall
I have an OpenBSD PF firewall that I have added a IPv6 tunnel to (using HE.net tunnelbroker).
I can ping/traceroute IPv6 addresses from the firewall. Now I want to provide IPv6 services to the ...
0
votes
1answer
386 views
Disable ALTQ for internal network traffic
I currently have a FreeBSD 8.2 media server set up on my LAN that I use to stream my music from.
I also have an SSH login that I use to do file transfers to and from this server remotely. I would ...
0
votes
1answer
223 views
FreeBSD machine not responding to first few packets of a stream
I have two machines running as reverse proxy caches/load balancers in front of a site I admin. Recently at peak times I've been seeing a problem where the first few packets from any stream of packets ...
0
votes
1answer
519 views
Using NTPD on OpenBSD to get time from Linux using portforwarding
This is a rehash of another question, now that I understand things a bit better.
I have the following network set up:
NTP
10.21.3.169
| \______________
| \
...
1
vote
1answer
193 views
PF firewall rules help
I'm having a heck of a time creating a pf ruleset for FTP.
What I'm trying to do is :
Only allow $WHITELIST to connect to FTP port 21
Open ports 49152 - 65535 for Passive port range
Can anyone ...
1
vote
1answer
535 views
mDNS on bridged OpenVPN network
I have openvpn running on a openbsd server that is behind a firewall, so it is a local member of the LAN. The openvpn is a bridge configuration.
firewall internal 10.0.10.1
openvpn server ...
1
vote
1answer
2k views
Help me upgrade my pf.conf for OpenBSD 4.7
I'm planning on upgrading my OpenBSD to 4.7 (from 4.6) and as you may or may not know, they changed the syntax for pf.conf.
This is the relevant portion from the upgrade guide:
pf(4) NAT syntax ...
1
vote
1answer
413 views
A jail that is accessible from network without port forwarding
I am using FreeBSD 7.1 and on my server I have two different jails. One for database and second one for game server. What I need to know is if it is possible to assign game server's jail to public IP ...
0
votes
2answers
1k views
PF firewall issues with FTP inside FreeBSD jail
I have recently tried to set up jails on one of my FreeBSD servers, and I’m running into strange errors while trying to download FreeBSD packages via FTP.
I have these rules in the PF firewall to ...
2
votes
1answer
372 views
Inaccurate bandwidth limiting in altq queues
I'm setting up an environment where I have one Linux server, one OpenBSD router and one Linux client and I want to be able to limit how much bandwidth the client should be able to use.
I've been ...
1
vote
2answers
2k views
FreeBSD+PF+Passive Firewall=Frustration
I have a FreeBSD server that I'm trying to get FTP working on. If I disable pf everything works great.
If I connect while pf is running I can login successfully-but as soon as I run an ls I get this:
...
0
votes
2answers
579 views
carp versus proxy arp
Currently I have a redundant pfSense firewall system set up for our corporate server farm. The main router IPs are sharing an IP address through Carp. Our two public /27 networks are assigned as ...
