pf is the OpenBSD Packet Filter, a feature-rich IP-layer firewall used on FreeBSD, NetBSD, and Mac OS X, as well as in the pfSense open-source firewall appliance software.

learn more… | top users | synonyms

1
vote
1answer
774 views

openbsd pf squid transparent proxy using a bridge

I want to use OpenBSD 5.7 as a filtering bridge in front of my router, and as part of that run a transparent proxy (squid 3.5.1) to manage web access. I have set up the openbsd machine as a bridge, ...
1
vote
1answer
275 views

FreeBSD pf with NFS

I'm having trouble establishing new NFS connections when my pf is turned on. When I turn off pf on the server and client I'm able to mount with no trouble. I tried keep state and flags S/SA on the ...
1
vote
1answer
240 views

Local transparent proxy OS X pf

I was trying to create local transparent proxy using this pf rules: rdr pass inet proto tcp from $Out to any port 80 -> 127.0.0.1 port 3129 pass out on $Out route-to lo0 inet proto tcp from $Out ...
1
vote
0answers
69 views

PF rule for Continuity

So it looks like the Continuity on OS X 10.10 creates network interface on the fly (utun2 here) and my PF blocks it, so that I can't make/answer calls. I'm not an admin, just use the IceFloor for PF ...
1
vote
1answer
546 views

Command to set dscp / ToS value on outgoing packets for OS X Mavericks?

I want to set a certain DSCP (or ToS) value on all packets sent over port 22. I have an iptables command to do so, but Mavericks only has the equivalent of pfctl and I can't figure out how to ...
1
vote
1answer
95 views

Mac OS X Firewall isn't firewalling

Rather confused by the results I'm getting on a Mac OS X Server running 10.8. I have an app that is running a web server on port 8000, which I want to be visible only to localhost. This seems ...
1
vote
0answers
104 views

PF Firewall Rules Help - Block IP Hammering

I'm having an issue where someone is using a VPN / proxy to hammer my server. They will pick on random URL from my website and perform ~20 requests per second to it. Once I ban the IP address, a few ...
1
vote
1answer
263 views

Limit ftp connections with pf firewall at FreeBSD

I want to limit simultaneous FTP connections to my FreeBSD server with the pf firewall. For example that only 10 simultaneous connection are possible to the port 20 or 21 from one source IP. I use ...
1
vote
0answers
83 views

Restrict “open” ethernet traffic to OpenVPN Traffic only when on a certain network

I would like to set up a pf or ipfw firewall rule on my Mac OS X 10.8 notebooks so that all Traffic on wireless and cabled networks is restricted to calling "home" through OpenVPN when I'm not in the ...
1
vote
1answer
272 views

How to filter TCP packets based on flags using Packet Filter

Well, I didn't know exactly how to ask this question, but I know that you can use the keyword flags to especify which flags you want to filter. According to the documentation of the Packet filter: ...
1
vote
1answer
287 views

PF firewall rules help

I'm having a heck of a time creating a pf ruleset for FTP. What I'm trying to do is : Only allow $WHITELIST to connect to FTP port 21 Open ports 49152 - 65535 for Passive port range Can anyone ...
1
vote
1answer
3k views

Help me upgrade my pf.conf for OpenBSD 4.7

I'm planning on upgrading my OpenBSD to 4.7 (from 4.6) and as you may or may not know, they changed the syntax for pf.conf. This is the relevant portion from the upgrade guide: pf(4) NAT syntax ...
0
votes
7answers
2k views

reroute DDOS to FBI Illegal? [closed]

Okay I know this might sound silly or dumb, but I would like to know (if anyone knows) if it would be illegal to reroute DDoS traffic to fbi.gov... I just thought it might be a good idea if you ...
0
votes
3answers
1k views

Does PF support divert like IPFW?

I'm currently using IPFW on 3 dedicated firewall servers, and I would like to convert them to PF for some of its functionalities, but I need divert to work. Specifically I am teeing packets to a ...
0
votes
1answer
561 views

PF firewall frontend [closed]

I'm running FreeBSD 9.2 and the PF firewall. I'm looking for an easier/faster way of adding and modifying my PF rules. Preferable a simple web ui. Is there any software like this available? I've ...
0
votes
2answers
2k views

PF firewall issues with FTP inside FreeBSD jail

I have recently tried to set up jails on one of my FreeBSD servers, and I’m running into strange errors while trying to download FreeBSD packages via FTP. I have these rules in the PF firewall to ...
0
votes
1answer
115 views

DNS lookup to localhost gives network error

I am running a recursive DNS server on Unbound in a jail on FreeBSD with pf as a firewall. Running drill @xxx.xxx.xxx.xxx example.com (where xxx.xxx.xxx.xxx is the servers IP) on my local machine ...
0
votes
2answers
560 views

How to run python script which required root privilage for execution in apache with mod_python at openbsd

I am trying to run python script in Apache 2.x with mod_python. I edited httpd.conf with publisher LoadModule python_module /usr/local/apache2/modules/mod_python.so <Directory ...
0
votes
1answer
3k views

freebsd pf squid transparent

I have broken my brain dealing with this. Squid was built from ports /usr/ports/www/squid32 with PF_TP enabled. I have internet but strangely it bypasses squid. Obviously, squid logs are empty. I ...
0
votes
2answers
549 views

using “include” like statement in pf.conf to include some parts from other files

I want to be able to include some parts of my pf.conf from other set of files. For example I will include "set timeout" vs like statements in another file. Using anchors and "load anchor from ...
0
votes
1answer
129 views

PF tagging then adding to table

could someone please provide an example on how to add a tagged packet to a table? I have found commands to do it from the command line but can you setup a specific rule to do it inside of pf.conf? ...
0
votes
1answer
658 views

traffic shaping on OSX 10.10 with pfctl and dnctl

I am trying to do traffic shaping (throttling) on Mac OS X 10.10 via pfctl and dnctl. I have implemented a simple test server and client with netcat (nc) and a synthetic random payload file to verify ...
0
votes
1answer
1k views

using pf for packet filtering and ipfw's dummynet for bandwidth limiting at the same time

I would like to ask if it's fine to use pf for all packet filtering (including using altq for traffic shaping) and ipfw's dummynet for bandwidth limiting certain IPs or subnets at the same time. I am ...
0
votes
1answer
563 views

correctly setup PF with loopback interfaces for nginx proxy

I am trying to run couple of freebsd jails for my web server and application server, which is running node.js I have one network card (igb0) with a custom loopback interface (lo666) for which i have ...
0
votes
1answer
401 views

FreeBSD pf Egress Filtering

I am attempting to build a simple pf.conf which includes NAT allowing traffic out of the network from all systems on a select series of ports. In my basic configuration I have an internal server that ...
0
votes
1answer
713 views

How to redirect a packet to localhost in pf?

I am trying to redirect packets that are going to internal network to localhost of firewall. I wrote this rule but it doesn't work. int_net = "{10.0.0.0/24}" ext_if = "{igb0}" int_if = "{igb1}" rdr ...
0
votes
1answer
165 views

Passing traffic to a service behind firewall

I am running nginx on port 8080, now I like to make it accessible from the internet, for that I open a port on my Router, next I add some rules to my PF, but a sniff from wireshark I see port ...
0
votes
1answer
373 views

OpenBSD ftp-proxy behind NAT itself

Is it possible to change the PASV IP ftp-proxy of OpenBSD sends to clients, without changing the listen address of redirection control (-b <address>)? I have the following setup: FTP client ...
0
votes
1answer
1k views

pfSense to ASA L2L VPN - infrequent, short-lasting, but consistent disconnections

Has anyone here been able to specify a stable configuration for the L2L VPN between an ASA device and pfSense 2.0.1? I am using the most accomodating settings on the ASA side (DefaultL2LGroup with ...
0
votes
1answer
617 views

OpenBsd 5 port forwarding

I'm trying to configure pf port forwarding on OpenBSD 5.0 The firewall machine has two nics: em0: 192.168.200.3 vic0: 192.65.214.136 I would like to forward all packets comming into ...
0
votes
2answers
3k views

Slow upload speeds with pfsense virtual appliance

I have a pfSense virtual appliance set up in front of a Windows server. The pfSense appliance has been configured with two L2L IPSec VPN sites and not too much else. The appliance has two vNics which ...
0
votes
2answers
68 views

Keep connection state with target machine in PF when reply comes from a different IP

I'm facing a challenge with my PF firewall on an OpenBSD machine. From a client (A) I'm connecting to a server (B) using a target ip (SRV-IP-1). The server is replying to my request, but sourcing the ...
0
votes
2answers
3k views

PF rules and configuration to allow a local IP alias to NAT on FreeBSD?

Here's exact details of my configuration: Firewall/DNS Server: 192.168.2.1 (local lan) which routes out to the internet. <-- NOT UNDER MY CONTROL My FreeBSD Server: 192.168.2.23 (LAN) "Inside" ...
0
votes
2answers
2k views

FreeBSD nat via PF: how to change from random UDP ports to incremental?

I'm testing NAT penetration code and need a symmetric NAT. I have configured FreeBSD with PF, very simple rule: # rl0 in WAN on DHCP, sk0 is LAN with computers behind this NAT. nat on rl0 from ...
0
votes
1answer
1k views

pf port forwarding

I've got the basics of my pf firewall/NAT router setup working; traffic going out fine, DNS requests on port 53 mapped into an internal subnet and back out again successfully (no change in port ...
0
votes
2answers
378 views

Packet Filter configuration to restrict traffic to the local host

I have been running a pf based filtering router on OpenBSD 4.3 for about a year now. My current task is to set up a new network segment for hosting our external sites. My aim is that machines set up ...
0
votes
1answer
36 views

Redirection of pfctl on OSX gets error

I want all my traffics are redirected to SOCKS proxy on 127.0.0.1:1080. I added the rule below to the end of /etc/pf.conf according to this tutorial: pass on en3 proto tcp from any to any rdr-to ...
0
votes
1answer
61 views

apache / mysql unable to connect jails with PF firewall

I have setup two jail environments on FreeBSD11 root@ns312773:/etc # jls JID IP Address Hostname Path 1 10.6.6.6 www ...
0
votes
0answers
66 views

Openbsd set connect on PPTP server behind packet filter

I have firewall on OpenBSD use Packet Filter and behind him MS Windows server with PPTP server. I need allow connect this PPTP server from internet. I set in OpenBSD: net.inet.gre.allow=1 ...
0
votes
0answers
134 views

pf.conf DNS dual redirect to dnscrypt-proxy. Just need confirmation my code is correct

I have 2 isolated LANS on my gateway. They are blocked from communicating to one another in pf by: block in log on $int_if from "192.168.1.0/25" to "192.168.1.128/25" block in log on $int_if from ...
0
votes
0answers
13 views

FreeBSD pf does not allow inbound smtp [duplicate]

I'm trying to figure out why the following simple pf config allows inbound SSH but not smtp (tcp 25). I'm running FreeBSD 10.1-RELEASE-p9, and the SMTP server is postfix 2.11.4. # ...
0
votes
1answer
360 views

Forwarding IP address using pf

I'm trying to forward an external IP address to another external IP address with pf. The equivalent iptables command would be iptables -t nat -A OUTPUT -d [ipaddress1] -j DNAT --to-destination ...
0
votes
1answer
1k views

port forwarding with pf on Mac OS 10.9

I have to setup a port forwarding on Mac Os 10.9. The mac is connected to a OpenVPN, and I need to get access to another machine on the private network of the mac through that VPN. Apparently, Mac OS ...
0
votes
0answers
101 views

FreeBSD - How can I let server A get web access via server B over a specific port?

Setup: Server A: FreeBSD 10 - IP: 100.100.100.100 Server B: FreeBSD 9 - IP: 200.200.200.200 Both servers use pf.conf. Desired result: I want server A to be able to get web access (port 80) via ...
0
votes
1answer
968 views

pf - redirect rule does not work

I'm using pf on FreeBSD 9. sshd is up and listening on loopback only (127.0.0.1). Trying to use redirect rule to allow network hosts to connect via ssh. set block-policy drop set skip on lo0 scrub ...
0
votes
1answer
527 views

pf not execute udp port specific block rule

The traffic I want to block can be sniffed as below with tcpdump: 19:16:22.391164 IP 95.95.95.95.2036 > 10.10.10.10.443: UDP, length 8192 So I wanted to write a rule block any udp destination ...
0
votes
1answer
1k views

Order of application of NAT rules in pfSense 2

In pfSense 2.0, I have a bunch of WAN CARP Virtual IPs and a bunch of 1:1 NAT rules defined associating these IPs to LAN subnet hosts. If I set up Port Forwarding rules that forward from CARP IPs ...
0
votes
1answer
5k views

OpenBSD 5.0 pf with NAT & Port Forwarding

Port forwarding does not seem to work properly, incoming connections apparently are blocked. Is there something wrong with my pf.conf? # Performance limits set limit states 200000 set limit ...
0
votes
1answer
540 views

Disable ALTQ for internal network traffic

I currently have a FreeBSD 8.2 media server set up on my LAN that I use to stream my music from. I also have an SSH login that I use to do file transfers to and from this server remotely. I would ...
0
votes
1answer
274 views

FreeBSD machine not responding to first few packets of a stream

I have two machines running as reverse proxy caches/load balancers in front of a site I admin. Recently at peak times I've been seeing a problem where the first few packets from any stream of packets ...