pf is the OpenBSD Packet Filter, a feature-rich IP-layer firewall used on OpenBSD, FreeBSD and NetBSD, as well as in the pfSense open-source firewall appliance software.

learn more… | top users | synonyms

2
votes
1answer
897 views

Getting per-ip traffic stats from PF

Is there a way to get per-ip traffic stats from PF on OpenBSD 4.9? pfctl can give me the total traffic (bytes) for a given label, and pfstats for a given interface, and pftop can give me a "live" view ...
4
votes
1answer
888 views

OpenBSD pf port forwarding multiple rules

I have a few dozen servers behind OpenBSD firewall with port forwarding. Most rules are very similar and differ only in IPs or sometimes in ports forwarded, so I want to compact them to remove ...
0
votes
2answers
56 views

Keep connection state with target machine in PF when reply comes from a different IP

I'm facing a challenge with my PF firewall on an OpenBSD machine. From a client (A) I'm connecting to a server (B) using a target ip (SRV-IP-1). The server is replying to my request, but sourcing the ...
0
votes
2answers
248 views

using “include” like statement in pf.conf to include some parts from other files

I want to be able to include some parts of my pf.conf from other set of files. For example I will include "set timeout" vs like statements in another file. Using anchors and "load anchor from ...
7
votes
3answers
1k views

OpenBSD/FreeBSD Firewall w/ GUI that is compatible with Intel 82574L Gigabit LAN NICs

I recently purchased a server to run m0n0wall or pfSense but I've learned since then that both of these firewall products are based on versions of FreeBSD which weren't yet compatible with the NICs in ...
0
votes
1answer
422 views

Disable ALTQ for internal network traffic

I currently have a FreeBSD 8.2 media server set up on my LAN that I use to stream my music from. I also have an SSH login that I use to do file transfers to and from this server remotely. I would ...
2
votes
1answer
696 views

How to check pf's queues?

I use FreeBSD and working with pf+ALTQ now. Something doesn't work and I need a tool to view what requests are marked and moved to a queue "queue_name" Need something like pftop but showing queues. ...
0
votes
2answers
2k views

PF rules and configuration to allow a local IP alias to NAT on FreeBSD?

Here's exact details of my configuration: Firewall/DNS Server: 192.168.2.1 (local lan) which routes out to the internet. <-- NOT UNDER MY CONTROL My FreeBSD Server: 192.168.2.23 (LAN) "Inside" ...
3
votes
1answer
96 views

blocking packets larger then specific size with pf

Is there a way with pf to block specific type of packets larger than specific size?
1
vote
1answer
227 views

PF firewall rules help

I'm having a heck of a time creating a pf ruleset for FTP. What I'm trying to do is : Only allow $WHITELIST to connect to FTP port 21 Open ports 49152 - 65535 for Passive port range Can anyone ...
1
vote
1answer
687 views

mDNS on bridged OpenVPN network

I have openvpn running on a openbsd server that is behind a firewall, so it is a local member of the LAN. The openvpn is a bridge configuration. firewall internal 10.0.10.1 openvpn server ...
3
votes
1answer
842 views

Provide IPv6 to network from OpenBSD firewall

I have an OpenBSD PF firewall that I have added a IPv6 tunnel to (using HE.net tunnelbroker). I can ping/traceroute IPv6 addresses from the firewall. Now I want to provide IPv6 services to the ...
0
votes
1answer
251 views

FreeBSD machine not responding to first few packets of a stream

I have two machines running as reverse proxy caches/load balancers in front of a site I admin. Recently at peak times I've been seeing a problem where the first few packets from any stream of packets ...
0
votes
1answer
919 views

Using NTPD on OpenBSD to get time from Linux using portforwarding

This is a rehash of another question, now that I understand things a bit better. I have the following network set up: NTP 10.21.3.169 | \______________ | \ ...
1
vote
1answer
606 views

A jail that is accessible from network without port forwarding

I am using FreeBSD 7.1 and on my server I have two different jails. One for database and second one for game server. What I need to know is if it is possible to assign game server's jail to public IP ...
0
votes
2answers
2k views

PF firewall issues with FTP inside FreeBSD jail

I have recently tried to set up jails on one of my FreeBSD servers, and I’m running into strange errors while trying to download FreeBSD packages via FTP. I have these rules in the PF firewall to ...
2
votes
1answer
403 views

Inaccurate bandwidth limiting in altq queues

I'm setting up an environment where I have one Linux server, one OpenBSD router and one Linux client and I want to be able to limit how much bandwidth the client should be able to use. I've been ...
0
votes
3answers
1k views

Does PF support divert like IPFW?

I'm currently using IPFW on 3 dedicated firewall servers, and I would like to convert them to PF for some of its functionalities, but I need divert to work. Specifically I am teeing packets to a ...
1
vote
2answers
2k views

FreeBSD+PF+Passive Firewall=Frustration

I have a FreeBSD server that I'm trying to get FTP working on. If I disable pf everything works great. If I connect while pf is running I can login successfully-but as soon as I run an ls I get this: ...
0
votes
1answer
840 views

pf port forwarding

I've got the basics of my pf firewall/NAT router setup working; traffic going out fine, DNS requests on port 53 mapped into an internal subnet and back out again successfully (no change in port ...
0
votes
2answers
1k views

FreeBSD nat via PF: how to change from random UDP ports to incremental?

I'm testing NAT penetration code and need a symmetric NAT. I have configured FreeBSD with PF, very simple rule: # rl0 in WAN on DHCP, sk0 is LAN with computers behind this NAT. nat on rl0 from ...
2
votes
1answer
744 views

Creating pflog interface

I'm attempting to create a pflog interface using ifconfig so I can log to more than one file and when I attempt to execute the following command I get this error. I'm attempting this on a vanilla ...
0
votes
1answer
123 views

PF tagging then adding to table

could someone please provide an example on how to add a tagged packet to a table? I have found commands to do it from the command line but can you setup a specific rule to do it inside of pf.conf? ...
0
votes
2answers
355 views

Packet Filter configuration to restrict traffic to the local host

I have been running a pf based filtering router on OpenBSD 4.3 for about a year now. My current task is to set up a new network segment for hosting our external sites. My aim is that machines set up ...
0
votes
7answers
2k views

reroute DDOS to FBI Illegal? [closed]

Okay I know this might sound silly or dumb, but I would like to know (if anyone knows) if it would be illegal to reroute DDoS traffic to fbi.gov... I just thought it might be a good idea if you ...
3
votes
3answers
2k views

NFS mount “hanging” when accessing from a server on a different subnet

Here's a problem which I am at a loss to diagnose: Our user home directories are served via NFS from an Apple XServe running Mac OS X 10.5.7. Normally they are exported to our default office subnet, ...