pf is the OpenBSD Packet Filter, a feature-rich IP-layer firewall used on FreeBSD, NetBSD, and Mac OS X, as well as in the pfSense open-source firewall appliance software.

learn more… | top users | synonyms

2
votes
3answers
626 views

How can one redirect to a new host all traffic destined for an old host?

We're moving a bunch of services, say from 1.2.3.4 to 5.6.7.8. In order to test that the new services are correctly configured, we'd like to redirect (to the new host) all traffic destined for the ...
2
votes
1answer
114 views

PF redirect rule: how to limit the rule to specific user

I was trying to setup a PF redirect rule to force all web traffic from a specific user account to go through a web filter on a shared computer. With iptables, I can use --uid-owner option to limit ...
2
votes
1answer
242 views

Is there an equivalent of LinuxIMQs in BSD?

Is there an equivalent of LinuxIMQs in BSD ? From linuximq.net: The imq device has two common usage cases: Ingress shaping: With linux only egress shaping is possible (except for the ingress ...
1
vote
1answer
774 views

openbsd pf squid transparent proxy using a bridge

I want to use OpenBSD 5.7 as a filtering bridge in front of my router, and as part of that run a transparent proxy (squid 3.5.1) to manage web access. I have set up the openbsd machine as a bridge, ...
1
vote
1answer
274 views

FreeBSD pf with NFS

I'm having trouble establishing new NFS connections when my pf is turned on. When I turn off pf on the server and client I'm able to mount with no trouble. I tried keep state and flags S/SA on the ...
1
vote
1answer
240 views

Local transparent proxy OS X pf

I was trying to create local transparent proxy using this pf rules: rdr pass inet proto tcp from $Out to any port 80 -> 127.0.0.1 port 3129 pass out on $Out route-to lo0 inet proto tcp from $Out ...
1
vote
1answer
544 views

Command to set dscp / ToS value on outgoing packets for OS X Mavericks?

I want to set a certain DSCP (or ToS) value on all packets sent over port 22. I have an iptables command to do so, but Mavericks only has the equivalent of pfctl and I can't figure out how to ...
1
vote
1answer
95 views

Mac OS X Firewall isn't firewalling

Rather confused by the results I'm getting on a Mac OS X Server running 10.8. I have an app that is running a web server on port 8000, which I want to be visible only to localhost. This seems ...
1
vote
1answer
263 views

Limit ftp connections with pf firewall at FreeBSD

I want to limit simultaneous FTP connections to my FreeBSD server with the pf firewall. For example that only 10 simultaneous connection are possible to the port 20 or 21 from one source IP. I use ...
1
vote
1answer
272 views

How to filter TCP packets based on flags using Packet Filter

Well, I didn't know exactly how to ask this question, but I know that you can use the keyword flags to especify which flags you want to filter. According to the documentation of the Packet filter: ...
1
vote
1answer
287 views

PF firewall rules help

I'm having a heck of a time creating a pf ruleset for FTP. What I'm trying to do is : Only allow $WHITELIST to connect to FTP port 21 Open ports 49152 - 65535 for Passive port range Can anyone ...
0
votes
1answer
36 views

Redirection of pfctl on OSX gets error

I want all my traffics are redirected to SOCKS proxy on 127.0.0.1:1080. I added the rule below to the end of /etc/pf.conf according to this tutorial: pass on en3 proto tcp from any to any rdr-to ...
0
votes
1answer
358 views

Forwarding IP address using pf

I'm trying to forward an external IP address to another external IP address with pf. The equivalent iptables command would be iptables -t nat -A OUTPUT -d [ipaddress1] -j DNAT --to-destination ...
0
votes
1answer
1k views

port forwarding with pf on Mac OS 10.9

I have to setup a port forwarding on Mac Os 10.9. The mac is connected to a OpenVPN, and I need to get access to another machine on the private network of the mac through that VPN. Apparently, Mac OS ...
0
votes
1answer
967 views

pf - redirect rule does not work

I'm using pf on FreeBSD 9. sshd is up and listening on loopback only (127.0.0.1). Trying to use redirect rule to allow network hosts to connect via ssh. set block-policy drop set skip on lo0 scrub ...
0
votes
1answer
526 views

pf not execute udp port specific block rule

The traffic I want to block can be sniffed as below with tcpdump: 19:16:22.391164 IP 95.95.95.95.2036 > 10.10.10.10.443: UDP, length 8192 So I wanted to write a rule block any udp destination ...
3
votes
0answers
173 views

pfSense Internal Traffic Policy Based Routing

What is the current and correct way to apply policy based routing to pfSense internal traffic (originating from the firewall itself)? Creating a floating rule with the WAN interfaces selected, ...
3
votes
0answers
189 views

How to split traffic through two different network adapters based on TCP port in OS X

I have a scenario where we will be using a Mac to stream video content to an RTMP server. This RMTP service provides 2 ingest URLs so that you can upload the same video content twice and have ...
3
votes
0answers
243 views

How to divert all OUTBOUND tcp traffic on port 1935 to localhost?

Mac OS X 10.10.3. I'm trying to use rtmpsrv. In order to do that, I have to redirect all outgoing tcp traffic on port 1935 to localhost. I tried: sudo sysctl -w net.inet.ip.forwarding=1 echo 'rdr ...
1
vote
0answers
32 views

Need to restart PF under OSX till it gets effective

is anybody here familiar with the use of PF under OSX? I'm using PF in order to force all the traffic on my MacBook going thru a VPN. In order to do so, I'm using the following pf.conf: wifi=en0 ...
1
vote
0answers
58 views

Using PF under OSX but skipping local interface

I'm using PF under OSX to force the OS the make all external connections via a VPN to Ipredator. However, as soon as I start PF all local connections are blocked even though I thought I told PF to ...
1
vote
0answers
302 views

Openbsd 5.7: IPv6 advertisement not working

--context-- I have a Sokeris with 8 interfaces: em0 is connected to a bridge router (ISP) and em2 is connected to my DMZ network (web servers). I got from my ISP a /56 prefix and 2 DNS IPs but no ...
1
vote
0answers
69 views

PF rule for Continuity

So it looks like the Continuity on OS X 10.10 creates network interface on the fly (utun2 here) and my PF blocks it, so that I can't make/answer calls. I'm not an admin, just use the IceFloor for PF ...
1
vote
0answers
104 views

PF Firewall Rules Help - Block IP Hammering

I'm having an issue where someone is using a VPN / proxy to hammer my server. They will pick on random URL from my website and perform ~20 requests per second to it. Once I ban the IP address, a few ...
1
vote
0answers
83 views

Restrict “open” ethernet traffic to OpenVPN Traffic only when on a certain network

I would like to set up a pf or ipfw firewall rule on my Mac OS X 10.8 notebooks so that all Traffic on wireless and cabled networks is restricted to calling "home" through OpenVPN when I'm not in the ...
0
votes
0answers
66 views

Openbsd set connect on PPTP server behind packet filter

I have firewall on OpenBSD use Packet Filter and behind him MS Windows server with PPTP server. I need allow connect this PPTP server from internet. I set in OpenBSD: net.inet.gre.allow=1 ...
0
votes
0answers
134 views

pf.conf DNS dual redirect to dnscrypt-proxy. Just need confirmation my code is correct

I have 2 isolated LANS on my gateway. They are blocked from communicating to one another in pf by: block in log on $int_if from "192.168.1.0/25" to "192.168.1.128/25" block in log on $int_if from ...
0
votes
0answers
101 views

FreeBSD - How can I let server A get web access via server B over a specific port?

Setup: Server A: FreeBSD 10 - IP: 100.100.100.100 Server B: FreeBSD 9 - IP: 200.200.200.200 Both servers use pf.conf. Desired result: I want server A to be able to get web access (port 80) via ...