pf is the OpenBSD Packet Filter, a feature-rich IP-layer firewall used on OpenBSD, FreeBSD and NetBSD, as well as in the pfSense open-source firewall appliance software.

learn more… | top users | synonyms

0
votes
1answer
125 views

PF tagging then adding to table

could someone please provide an example on how to add a tagged packet to a table? I have found commands to do it from the command line but can you setup a specific rule to do it inside of pf.conf? ...
0
votes
1answer
427 views

using pf for packet filtering and ipfw's dummynet for bandwidth limiting at the same time

I would like to ask if it's fine to use pf for all packet filtering (including using altq for traffic shaping) and ipfw's dummynet for bandwidth limiting certain IPs or subnets at the same time. I am ...
0
votes
1answer
70 views

Expanding a macro containing a subnet IP address with prefix (CIDR) in a list using PF firewall

I’m trying to expand a macro that contains an address with a subnet mask into a list with PF like so: subnet1 = "192.168.1.0/24" subnet2 = "10.0.0.0/8" subnets = "{" $subnet1 $subnet2 "}" But this ...
0
votes
1answer
222 views

FreeBSD pf Egress Filtering

I am attempting to build a simple pf.conf which includes NAT allowing traffic out of the network from all systems on a select series of ports. In my basic configuration I have an internal server that ...
0
votes
1answer
238 views

How to redirect a packet to localhost in pf?

I am trying to redirect packets that are going to internal network to localhost of firewall. I wrote this rule but it doesn't work. int_net = "{10.0.0.0/24}" ext_if = "{igb0}" int_if = "{igb1}" rdr ...
0
votes
2answers
283 views

How to run python script which required root privilage for execution in apache with mod_python at openbsd

I am trying to run python script in Apache 2.x with mod_python. I edited httpd.conf with publisher LoadModule python_module /usr/local/apache2/modules/mod_python.so <Directory ...
0
votes
1answer
136 views

Passing traffic to a service behind firewall

I am running nginx on port 8080, now I like to make it accessible from the internet, for that I open a port on my Router, next I add some rules to my PF, but a sniff from wireshark I see port ...
0
votes
1answer
228 views

OpenBSD ftp-proxy behind NAT itself

Is it possible to change the PASV IP ftp-proxy of OpenBSD sends to clients, without changing the listen address of redirection control (-b <address>)? I have the following setup: FTP client ...
0
votes
1answer
879 views

pfSense to ASA L2L VPN - infrequent, short-lasting, but consistent disconnections

Has anyone here been able to specify a stable configuration for the L2L VPN between an ASA device and pfSense 2.0.1? I am using the most accomodating settings on the ASA side (DefaultL2LGroup with ...
0
votes
1answer
490 views

OpenBsd 5 port forwarding

I'm trying to configure pf port forwarding on OpenBSD 5.0 The firewall machine has two nics: em0: 192.168.200.3 vic0: 192.65.214.136 I would like to forward all packets comming into ...
0
votes
2answers
2k views

Slow upload speeds with pfsense virtual appliance

I have a pfSense virtual appliance set up in front of a Windows server. The pfSense appliance has been configured with two L2L IPSec VPN sites and not too much else. The appliance has two vNics which ...
0
votes
2answers
59 views

Keep connection state with target machine in PF when reply comes from a different IP

I'm facing a challenge with my PF firewall on an OpenBSD machine. From a client (A) I'm connecting to a server (B) using a target ip (SRV-IP-1). The server is replying to my request, but sourcing the ...
0
votes
2answers
2k views

PF rules and configuration to allow a local IP alias to NAT on FreeBSD?

Here's exact details of my configuration: Firewall/DNS Server: 192.168.2.1 (local lan) which routes out to the internet. <-- NOT UNDER MY CONTROL My FreeBSD Server: 192.168.2.23 (LAN) "Inside" ...
0
votes
2answers
1k views

FreeBSD nat via PF: how to change from random UDP ports to incremental?

I'm testing NAT penetration code and need a symmetric NAT. I have configured FreeBSD with PF, very simple rule: # rl0 in WAN on DHCP, sk0 is LAN with computers behind this NAT. nat on rl0 from ...
0
votes
1answer
884 views

pf port forwarding

I've got the basics of my pf firewall/NAT router setup working; traffic going out fine, DNS requests on port 53 mapped into an internal subnet and back out again successfully (no change in port ...
0
votes
2answers
357 views

Packet Filter configuration to restrict traffic to the local host

I have been running a pf based filtering router on OpenBSD 4.3 for about a year now. My current task is to set up a new network segment for hosting our external sites. My aim is that machines set up ...
0
votes
1answer
457 views

port forwarding with pf on Mac OS 10.9

I have to setup a port forwarding on Mac Os 10.9. The mac is connected to a OpenVPN, and I need to get access to another machine on the private network of the mac through that VPN. Apparently, Mac OS ...
0
votes
0answers
24 views

Will pfctl -sr show ordered rules when using -o profile?

When I enable the -o profile option with pf will pfctl -sr show me the new order of the rules?
0
votes
0answers
42 views

FreeBSD - How can I let server A get web access via server B over a specific port?

Setup: Server A: FreeBSD 10 - IP: 100.100.100.100 Server B: FreeBSD 9 - IP: 200.200.200.200 Both servers use pf.conf. Desired result: I want server A to be able to get web access (port 80) via ...
0
votes
0answers
65 views

Mac OS X Firewall isn't firewalling

Rather confused by the results I'm getting on a Mac OS X Server running 10.8. I have an app that is running a web server on port 8000, which I want to be visible only to localhost. This seems ...
0
votes
1answer
228 views

correctly setup PF with loopback interfaces for nginx proxy

I am trying to run couple of freebsd jails for my web server and application server, which is running node.js I have one network card (igb0) with a custom loopback interface (lo666) for which i have ...
0
votes
0answers
252 views

Proxy outbound connections throught squid

Informations FreeBSD 10.0 Squid 2.7 PF Scenario All the connections need to pass through an external authenticated proxy, so i need to proxy all outbound ftp and http connections through a ...
0
votes
1answer
233 views

pf - redirect rule does not work

I'm using pf on FreeBSD 9. sshd is up and listening on loopback only (127.0.0.1). Trying to use redirect rule to allow network hosts to connect via ssh. set block-policy drop set skip on lo0 scrub ...
0
votes
0answers
138 views

openbsd pf rdr-to not working

I have multiple IP addresses aliased on my external interface and I am trying to forward from one of those IPs to an internal address for port 80. My (sanitised) config is as follows: set limit ...
0
votes
1answer
266 views

pf not execute udp port specific block rule

The traffic I want to block can be sniffed as below with tcpdump: 19:16:22.391164 IP 95.95.95.95.2036 > 10.10.10.10.443: UDP, length 8192 So I wanted to write a rule block any udp destination ...
0
votes
0answers
252 views

PF, redirecting SSH to internal VM

I run a FreeBSD server with VirtualBox on it. There's a VM in there I'd like to contact via SSH directly using Port 20000. Client and FreeBSD server are connected through OpenVPN via tun. The ...
0
votes
1answer
706 views

Order of application of NAT rules in pfSense 2

In pfSense 2.0, I have a bunch of WAN CARP Virtual IPs and a bunch of 1:1 NAT rules defined associating these IPs to LAN subnet hosts. If I set up Port Forwarding rules that forward from CARP IPs ...
0
votes
1answer
4k views

OpenBSD 5.0 pf with NAT & Port Forwarding

Port forwarding does not seem to work properly, incoming connections apparently are blocked. Is there something wrong with my pf.conf? # Performance limits set limit states 200000 set limit ...
0
votes
1answer
462 views

Disable ALTQ for internal network traffic

I currently have a FreeBSD 8.2 media server set up on my LAN that I use to stream my music from. I also have an SSH login that I use to do file transfers to and from this server remotely. I would ...
0
votes
1answer
260 views

FreeBSD machine not responding to first few packets of a stream

I have two machines running as reverse proxy caches/load balancers in front of a site I admin. Recently at peak times I've been seeing a problem where the first few packets from any stream of packets ...
0
votes
1answer
1k views

Using NTPD on OpenBSD to get time from Linux using portforwarding

This is a rehash of another question, now that I understand things a bit better. I have the following network set up: NTP 10.21.3.169 | \______________ | \ ...
0
votes
2answers
839 views

carp versus proxy arp

Currently I have a redundant pfSense firewall system set up for our corporate server farm. The main router IPs are sharing an IP address through Carp. Our two public /27 networks are assigned as ...