Hot answers tagged

40

Help! My house is on fire! Lets burn down the fire station to get their attention!


22

Doing as you propose is unethical, potentially illegal and technically pointless. Redirecting your DDoS traffic to another site makes you as complicit in the attack as the people attacking you. You do not like dealing with the mess that such an attack causes; why do you think that the sysadmin at any other site will like it more. How would you feel if ...


8

Incredibly poor idea. pf is not magic - all that setting it to forward DDoS traffic to the FBI will accomplish is make your machine attempt to perform a haphazard DoS against the FBI's web server.


6

pfSense 2.0 has back ported Intel drivers from FreeBSD 9 so that will definitely work, and is generally the preferred release for new deployments anyway. m0n0wall snapshot versions should work too.


5

Try pfctl -s queue -v or pfctl -s queue -v -v for continuous output.


5

Try this on the shell to disable PF temporarily: pfctl -d Then once you are able to login and create the rules turn PF back on with: pfctl -e I've had to do exactly what you describe before when I locked myself out remotely.


5

Sorry, what you're asking for is impossible -- IP traffic (and an IP firewall) only knows IP addresses - it knows nothing of hostnames. You can only have one process listening to a specific port on a specific IP address. Virtual hosts for websites work because the web server receives the hostname in an HTTP header (see http://en.wikipedia.org/wiki/...


5

You can do it with PF as well. However, rdr only accepts incoming packets. Thus, you have to first route those packets to lo0, then add a rdr rule there (which will catch them as they will be routed in from "somewhere") to send them to your local ssh server. The order is necessarily rdr stuff, then filter stuff (like pass), but chronologically the 2nd rule ...


5

AFAIK, pf does not have the flexibility and modules available in iptables. iptables comes with really large number of modules that provide more match options and others that provide more targets. You can even develop your own module. This page provides some explanation regarding iptables development if you are interested.


4

Just wanted to update on this in case anyone runs in to the same problem. Essentially it comes down to the state rules in Pf. By default Pf keeps state, and uses S/SA as a mask. However, it seems that the NFS server implementation on OS X attempts to start a conversation back to the client using a non-standard set of flags. This was causing it to fail ...


4

If I remember correctly: PF has a special interface for monitoring purposes (pflog). You might wanna consult the manpage for it.


4

First, you should configure the LAN NIC to an address from the routed(!) /64; the ::1 is an ideal candidate. Then, fire up radvd on the LAN interface---it should not need any configuration. PF doesn't play any role in it, or rather, make sure that it doesn't get in the way.


4

To list all values, try pfctl -s all To list only the limits you requested, try pfctl -s memory To list only the timeouts you requested, try pfctl -s timeouts Out of the curiosity: Are you sure you need to adjust those values? Are you sure you can outsmart the default values, if merely listing the values is not familiar to you?


4

The source-track option does apply per-rule, so you are not restricting "Google to X req/day", you are restricting each individual address to that limit. I give you two solutions here. One is simple and approximate, the other is harder and sharper. Solution 1 Transform the condition so as to match all servers of interest in one rule. The simplest approach ...


4

The 9.0 branch seems to be particularly sensitive to odd configurations where TCP Segmentation Offload is involved. This can be "corrected" by disabling TSO: ifconfig em0 -tso


4

In FreeBSD the firewalls (IPF, IPFW, and PF) sit between the Device Driver and the IP Stack. Routing is part of the IP Stack.


4

its because its specifying a single ip, you need to write it with the subnet: pass in from 111.111.0.0/16 man pf.conf should list a few methods of defining ranges and blocks. A side note, take care to ensure there are no drop quick kind of rules above your pass, and no rules below that could accidently match and block your packets.


3

AFAIC, pf can't do this. You can use ipfw's iplen option: iplen len-list Matches IP packets whose total length, including header and data, is in the set len-list, which is either a single value or a list of values or ranges specified in the same way as ports.


3

you can listen multiple times on the same pflog0 and use bpf filters to split them up pflogd0 -f /var/log/pf.blocked action block pflogd0 -f /var/log/pf.passed action pass pflogd0 -f /var/log/pf.rule.15 rulenum 15 pflogd0 -f /var/log/pf.fxp0 on fxp0 (c) Mike Frantzen PS. right syntax is ifconfig pflog1 create


3

According to http://lists.freebsd.org/pipermail/freebsd-pf/2008-October/004826.html you can't load queues into anchors as I'm trying to do. You have to load the queue rules in to the main pf.conf file and load only the filter rules that assign traffic to the queue(s) into the anchor.


3

The "extra" options were deprecated by OpenBSD over 9 years ago and removed in pfctl revision 1.143 (Mar 23, 2010) with the following comments: remove -A, -O, -R and -T load the partial loading of a ruleset (leaving ancors aside) is wrong and conflicts with the general idea of how pf works. last not least it breaks with the optimizer generating ...


3

pfsense is a firewall OS and is based on FreeBSD And PF and would offer you a fully web based GUI. for more information check out http://www.pfsense.org


3

No, there isn't. You know that it's trivial for people to change their MAC addresses, correct? Additionally, the instant a packet passes through a later 3 routing device, the Mac address information of the source machine is lost. So even if you did want to do something like this, it would only ever work for clients that are on the same L2 LAN as your server....


3

The message is normal because ALTQ is not compiled into the stock FreeBSD kernel. Unless you need to use ALTQ it doesn't matter. The start up of the firewall interrupts all current connections, including your ssh session, which stops responding. Just open another terminal and log in again. The original session will eventually time out. It's a good idea to ...


2

I don't believe you can. Nor do I understand why you'd need to. Your second rule (once already tagged) would just operate on the tag rather than a table. It might help for you to include an example of what you want to achieve.


2

No, in OpenBSD v4.6 version, PF has no divert-like feature. But good news, divert for PF will be included in OpenBSD v4.7 version See http://www.mail-archive.com/source-changes@openbsd.org/msg11694.html for details. You could try it with OpenBSD-current branch / snapshots.


2

In my experience for altq to work well you really need to add the red, rio or ecn option to your limiting queues, otherwise as you approach saturation (physical or queue-virtual) you're in for some unpleasant situations. Take a look at the section on RED (Random Early Detection) in the altq howto for more info. Also, two problems with your snippet above: ...


2

The problem is related to the fact that Passive FTP uses ports other than 21. Read about it here: http://slacksite.com/other/ftp.html Usually if I setup an FTP server I'll either whitelist hosts like voretaq said or you can usually set the passive port range to use in the FTP config and just open those ports.


2

To cover the obvious - you are running the ftp-proxy daemon, and your securelevel is <= 1, right? (see also the ftp-proxy(8) manpage which is probably more helpful than I will be - FTP and I don't get along) In my experience FTP is horribly broken behind any halfway decent firewall -- typically I give up and allow all outbound traffic (& stateful ...



Only top voted, non community-wiki answers of a minimum length are eligible