Questions tagged [pf]
pf is the OpenBSD Packet Filter, a feature-rich IP-layer firewall used on FreeBSD, NetBSD, and Mac OS X, as well as in the pfSense open-source firewall appliance software.
42
questions with no upvoted or accepted answers
6
votes
0
answers
1k
views
pfSense Internal Traffic Policy Based Routing
What is the current and correct way to apply policy based routing to pfSense internal traffic (originating from the firewall itself)? Creating a floating rule with the WAN interfaces selected, ...
3
votes
0
answers
641
views
How to split traffic through two different network adapters based on TCP port in OS X
I have a scenario where we will be using a Mac to stream video content to an RTMP server. This RMTP service provides 2 ingest URLs so that you can upload the same video content twice and have ...
3
votes
0
answers
875
views
How to divert all OUTBOUND tcp traffic on port 1935 to localhost?
Mac OS X 10.10.3.
I'm trying to use rtmpsrv. In order to do that, I have to redirect all outgoing tcp traffic on port 1935 to localhost. I tried:
sudo sysctl -w net.inet.ip.forwarding=1
echo 'rdr ...
2
votes
0
answers
359
views
pfctl not relaying SYN, ACK packet after NAT
I am trying to relay SSH connections from LAN hosts to hosts beyond VPN.
Only one router host in the LAN has VPN connection to be reused by other hosts in LAN.
Below is pfctl configuration on the ...
2
votes
0
answers
728
views
Allowing Incoming Traffic over IPv6 with PF on FreeBSD
This is my current pf.conf on FreeBSD 11.1-RELEASE. It allows incoming connections from OpenVPN/UDP and SSH, as well as allows everything on the private/vpn networks (vtnet1 and tun0 respectively). ...
2
votes
0
answers
813
views
Configuring PF to route between routing domains
I've got an OpenBSD 6.0 box running as a router / firewall. It's got three physical network connections and one GRE tunnel:
em0: Internet (routing domain 0)
em1: Internal LAN private IPs (routing ...
2
votes
1
answer
491
views
PF redirect rule: how to limit the rule to specific user
I was trying to setup a PF redirect rule to force all web traffic from a specific user account to go through a web filter on a shared computer.
With iptables, I can use --uid-owner option to limit ...
2
votes
1
answer
380
views
Is there an equivalent of LinuxIMQs in BSD?
Is there an equivalent of LinuxIMQs in BSD ?
From linuximq.net:
The imq device has two common usage cases:
Ingress shaping:
With linux only egress shaping is possible (except for the ingress ...
2
votes
2
answers
609
views
PF firewall rules help
I'm having a heck of a time creating a pf ruleset for FTP.
What I'm trying to do is :
Only allow $WHITELIST to connect to FTP port 21
Open ports 49152 - 65535 for Passive port range
Can anyone ...
2
votes
1
answer
3k
views
Command to set dscp / ToS value on outgoing packets for OS X Mavericks?
I want to set a certain DSCP (or ToS) value on all packets sent over port 22. I have an iptables command to do so, but Mavericks only has the equivalent of pfctl and I can't figure out how to ...
1
vote
1
answer
498
views
Simple OpenBSD NAT router not working
I'm toying around with using OpenBSD as a NAT router behind Starlink but efforts with the NAT are failing even in the simplest cases. I've probably simply been staring at it too long and need an ...
1
vote
0
answers
64
views
Mysterious/Unknown IPs keep getting whitelisted by spamd
I have an OpenBSD 7.1 mail server running OpenSMTPD with spamd.
I notice mysterious IP addresses in /var/log/maillog, such as:
smtp connected address=162.142.125.222 host=scanner-25.ch1.censys-scanner....
1
vote
0
answers
2k
views
Redirecting traffic to a bridged ip and port using PF on MacOS
I am trying to redirect localhost traffic on specific port to bridged network ip
I am using following
echo "
rdr pass inet proto tcp from any to any port 9300 -> 192.168.64.29 port 9300
rdr ...
1
vote
0
answers
125
views
Share a VPN connection via a node in a LAN
I would like to share a VPN connection via a node in the same LAN.
The scheme below shows my network system.
LAN A: 10.44.247.0/24
|-* Router Aa: 10.44.247.1, ext XXX.XXX.XXX.XXX
|-* Node Ab: 10....
1
vote
0
answers
445
views
I fail to configure Pf of OpenBSD gateway
I have an OpenBSD server that I want to use as a gateway.
OBSD server has the following interfaces -
em5 (130...** ext.IP with internet connectivity)
em0 (internal IP - 172.16.0.0/17)
My default ...
1
vote
0
answers
787
views
(Mac OS PF) Redirect outgoing UDP traffice to specific ip:port
I'm having some trouble getting my head around how PF works in Mac OS. I have been doing a lot of research on the topic but just cannot find the solution (although I can find many other very similar ...
1
vote
0
answers
398
views
pf on os x server 10.10 doesn't block addresses added to a table
I'm trying to understand the issue with pf on OS X 10.10 El Capitan.
I have installed sshguard and try to make it work by adding
table <sshguard> persist
block in quick proto tcp from <...
1
vote
2
answers
2k
views
Block DNS query using pfctl
I am trying to create rule to allow DNS queries (port 53) to only 8.8.8.8 server (Google DNS). DNS queries to all other servers should not succeed.
I added the following lines to /etc/pf.conf file
...
1
vote
0
answers
738
views
Need to restart PF under OSX till it gets effective
is anybody here familiar with the use of PF under OSX? I'm using PF in order to force all the traffic on my MacBook going thru a VPN. In order to do so, I'm using the following pf.conf:
wifi=en0
...
1
vote
0
answers
910
views
Using PF under OSX but skipping local interface
I'm using PF under OSX to force the OS the make all external connections via a VPN to Ipredator. However, as soon as I start PF all local connections are blocked even though I thought I told PF to ...
1
vote
0
answers
1k
views
Openbsd 5.7: IPv6 advertisement not working
--context--
I have a Sokeris with 8 interfaces: em0 is connected to a bridge router (ISP) and em2 is connected to my DMZ network (web servers).
I got from my ISP a /56 prefix and 2 DNS IPs but no ...
1
vote
1
answer
3k
views
openbsd pf squid transparent proxy using a bridge
I want to use OpenBSD 5.7 as a filtering bridge in front of my router, and as part of that run a transparent proxy (squid 3.5.1) to manage web access. I have set up the openbsd machine as a bridge, ...
1
vote
1
answer
1k
views
Local transparent proxy OS X pf
I was trying to create local transparent proxy using this pf rules:
rdr pass inet proto tcp from $Out to any port 80 -> 127.0.0.1 port 3129
pass out on $Out route-to lo0 inet proto tcp from $Out ...
1
vote
0
answers
105
views
PF rule for Continuity
So it looks like the Continuity on OS X 10.10 creates network interface on the fly (utun2 here) and my PF blocks it, so that I can't make/answer calls.
I'm not an admin, just use the IceFloor for PF ...
1
vote
1
answer
126
views
Mac OS X Firewall isn't firewalling
Rather confused by the results I'm getting on a Mac OS X Server running 10.8. I have an app that is running a web server on port 8000, which I want to be visible only to localhost. This seems ...
1
vote
0
answers
176
views
PF Firewall Rules Help - Block IP Hammering
I'm having an issue where someone is using a VPN / proxy to hammer my server. They will pick on random URL from my website and perform ~20 requests per second to it.
Once I ban the IP address, a few ...
1
vote
1
answer
404
views
Limit ftp connections with pf firewall at FreeBSD
I want to limit simultaneous FTP connections to my FreeBSD server with the pf firewall. For example that only 10 simultaneous connection are possible to the port 20 or 21 from one source IP.
I use ...
1
vote
0
answers
101
views
Restrict "open" ethernet traffic to OpenVPN Traffic only when on a certain network
I would like to set up a pf or ipfw firewall rule on my Mac OS X 10.8 notebooks so that all Traffic on wireless and cabled networks is restricted to calling "home" through OpenVPN when I'm not in the ...
1
vote
1
answer
3k
views
How to filter TCP packets based on flags using Packet Filter
Well, I didn't know exactly how to ask this question, but I know that you can use the keyword flags to especify which flags you want to filter.
According to the documentation of the Packet filter:
...
0
votes
1
answer
208
views
FreeBSD: How can I tune the lifetime for TCP/UDP for in kernel NAT?
There used to be these sysctls in older versions of FreeBSD, viz:
net.inet.ip.fw.dyn_ack_lifetime=3600
net.inet.ip.fw.dyn_udp_lifetime=15
now on FreeBSD 12 sysctl reports that these don't exist.
How ...
0
votes
0
answers
181
views
PF Nat over OpenVPN Client
I have FreeBSD 12.1-RELEASE router with 3 interfaces:
LAN HOME(192.168.22.)
LAN WORK(192.168.11.)
WAN(1.2.3.4)
My router connect to NordVPN over OpenVPN as a client (creates new TUN0 with address 10....
0
votes
1
answer
598
views
How to specify an IP range representing "any IP" within a Pfsense alias?
I've restricted the source IP of many rules to some alias, say Trusted_Sources.
Now, for some reason, I want to open all these rules to the world without manually modifying each individual rule.
How ...
0
votes
1
answer
114
views
freebsd packet filter match last digit of IP address
On my freebsd system I want to use port forwarding to distribute incoming traffic, based on the last digit of the source IP.
The following works on linux with iptables:
iptables -t nat -A ...
0
votes
0
answers
107
views
How come that with these packet filter rules, this rule triggers?
I have (amongst others) these rules in my pf setup:
block drop in log (user) proto udp from any to any port = 137
block drop in log (user) proto udp from any to any port = 138
block drop in log (user)...
0
votes
1
answer
1k
views
Setting DSCP value on specific outgoing traffic in OS X with pf
I want to set DSCP value on specific traffic coming out of an OS X machine.
I think the right way is to use pf, but I can't figure how to write the rule correctly.
I've tried something like this but ...
0
votes
1
answer
157
views
FreeBSD and pf - packet filtering based on OpenVPN usernames
I have an OpenVPN server which authenticates the users using an Active Directory server. I need to limit the bandwidth of each user based on their usernames, and I also want to be able to do some ...
0
votes
2
answers
681
views
FreeBSD-12.0 PF firewall default rule is blocking when more specific rule allowing is ignored
Our PF firewall contains this:
. . .
scrub in all fragment reassemble no-df max-mss 1440
### em1 ipv4 = 123.12.3.234
nat log on $ext_if \
from $net_nat \
...
0
votes
2
answers
818
views
openbsd pf firewall - how can I tell what is being blocked?
I am in a dire situation. Our exchange server disks have failed. I can still use the application as the os disks are unaffected, and I need to do an emergency migration to office365.
We have an ...
0
votes
0
answers
67
views
Real meaning of "in" and "out" regarding a virtual network
I am confused, I thought I understand those basics but now I'm not quite sure any more...
Considering that conf :
cloned_interfaces="lo7"
ifconfig_bce0="dhcp"
ifconfig_bce0_alias0="inet 192.168.0.1/...
0
votes
0
answers
133
views
FreeBSD - How can I let server A get web access via server B over a specific port?
Setup:
Server A: FreeBSD 10 - IP: 100.100.100.100
Server B: FreeBSD 9 - IP: 200.200.200.200
Both servers use pf.conf.
Desired result:
I want server A to be able to get web access (port 80) via ...
0
votes
1
answer
942
views
pf not execute udp port specific block rule
The traffic I want to block can be sniffed as below with tcpdump:
19:16:22.391164 IP 95.95.95.95.2036 > 10.10.10.10.443: UDP, length 8192
So I wanted to write a rule block any udp destination ...
0
votes
2
answers
2k
views
PF blocking out Flags [FP.]
On a FreeBSD 12 server, I started to notice that pf is blocking out having Flags [FP.], the logs are flooded with something like this:
00:00:00.000004 rule 2/0(match): block out on bge0: 213.59.241....