Tag Info

Hot answers tagged

40

Help! My house is on fire! Lets burn down the fire station to get their attention!


22

Doing as you propose is unethical, potentially illegal and technically pointless. Redirecting your DDoS traffic to another site makes you as complicit in the attack as the people attacking you. You do not like dealing with the mess that such an attack causes; why do you think that the sysadmin at any other site will like it more. How would you feel if ...


8

Incredibly poor idea. pf is not magic - all that setting it to forward DDoS traffic to the FBI will accomplish is make your machine attempt to perform a haphazard DoS against the FBI's web server.


5

pfSense 2.0 has back ported Intel drivers from FreeBSD 9 so that will definitely work, and is generally the preferred release for new deployments anyway. m0n0wall snapshot versions should work too.


5

Try this on the shell to disable PF temporarily: pfctl -d Then once you are able to login and create the rules turn PF back on with: pfctl -e I've had to do exactly what you describe before when I locked myself out remotely.


5

Sorry, what you're asking for is impossible -- IP traffic (and an IP firewall) only knows IP addresses - it knows nothing of hostnames. You can only have one process listening to a specific port on a specific IP address. Virtual hosts for websites work because the web server receives the hostname in an HTTP header (see ...


4

Just wanted to update on this in case anyone runs in to the same problem. Essentially it comes down to the state rules in Pf. By default Pf keeps state, and uses S/SA as a mask. However, it seems that the NFS server implementation on OS X attempts to start a conversation back to the client using a non-standard set of flags. This was causing it to fail ...


4

If I remember correctly: PF has a special interface for monitoring purposes (pflog). You might wanna consult the manpage for it.


4

Try pfctl -s queue -v or pfctl -s queue -v -v for continuous output.


4

First, you should configure the LAN NIC to an address from the routed(!) /64; the ::1 is an ideal candidate. Then, fire up radvd on the LAN interface---it should not need any configuration. PF doesn't play any role in it, or rather, make sure that it doesn't get in the way.


4

To list all values, try pfctl -s all To list only the limits you requested, try pfctl -s memory To list only the timeouts you requested, try pfctl -s timeouts Out of the curiosity: Are you sure you need to adjust those values? Are you sure you can outsmart the default values, if merely listing the values is not familiar to you?


4

The source-track option does apply per-rule, so you are not restricting "Google to X req/day", you are restricting each individual address to that limit. I give you two solutions here. One is simple and approximate, the other is harder and sharper. Solution 1 Transform the condition so as to match all servers of interest in one rule. The simplest approach ...


4

In FreeBSD the firewalls (IPF, IPFW, and PF) sit between the Device Driver and the IP Stack. Routing is part of the IP Stack.


4

its because its specifying a single ip, you need to write it with the subnet: pass in from 111.111.0.0/16 man pf.conf should list a few methods of defining ranges and blocks. A side note, take care to ensure there are no drop quick kind of rules above your pass, and no rules below that could accidently match and block your packets.


3

AFAIC, pf can't do this. You can use ipfw's iplen option: iplen len-list Matches IP packets whose total length, including header and data, is in the set len-list, which is either a single value or a list of values or ranges specified in the same way as ports.


3

you can listen multiple times on the same pflog0 and use bpf filters to split them up pflogd0 -f /var/log/pf.blocked action block pflogd0 -f /var/log/pf.passed action pass pflogd0 -f /var/log/pf.rule.15 rulenum 15 pflogd0 -f /var/log/pf.fxp0 on fxp0 (c) Mike Frantzen PS. right syntax is ifconfig pflog1 create


3

The "extra" options were deprecated by OpenBSD over 9 years ago and removed in pfctl revision 1.143 (Mar 23, 2010) with the following comments: remove -A, -O, -R and -T load the partial loading of a ruleset (leaving ancors aside) is wrong and conflicts with the general idea of how pf works. last not least it breaks with the optimizer generating ...


3

pfsense is a firewall OS and is based on FreeBSD And PF and would offer you a fully web based GUI. for more information check out http://www.pfsense.org


2

Using any firewall as DDoS protection is a bad idea. DDoS attacks hit the most resource-intensive portion of any firewall, evaluating its ruleset for huge numbers of new connections. DDoS attacks melt down any firewall very quickly. How quickly and how big of an attack one can handle depends on how big of a firewall. In general, you don't want to look at a ...


2

I don't believe you can. Nor do I understand why you'd need to. Your second rule (once already tagged) would just operate on the tag rather than a table. It might help for you to include an example of what you want to achieve.


2

The problem is related to the fact that Passive FTP uses ports other than 21. Read about it here: http://slacksite.com/other/ftp.html Usually if I setup an FTP server I'll either whitelist hosts like voretaq said or you can usually set the passive port range to use in the FTP config and just open those ports.


2

To cover the obvious - you are running the ftp-proxy daemon, and your securelevel is <= 1, right? (see also the ftp-proxy(8) manpage which is probably more helpful than I will be - FTP and I don't get along) In my experience FTP is horribly broken behind any halfway decent firewall -- typically I give up and allow all outbound traffic (& stateful ...


2

No, in OpenBSD v4.6 version, PF has no divert-like feature. But good news, divert for PF will be included in OpenBSD v4.7 version See http://www.mail-archive.com/source-changes@openbsd.org/msg11694.html for details. You could try it with OpenBSD-current branch / snapshots.


2

I haven't used pf; but I think it was one of the first statefull filters. Maybe it's keeping account of the 'connections' and dropping them? I'd look for any state-dependent filter rule. In Linux's iptables usually the filter starts with a ACCEPT all state RELATED,ESTABLISHED because that way it won't have to recheck all the relevant rules for each ...


2

By default FTP uses so called 'Active' mode for data transfer which is not very firewall friendly. In this mode FTP server connects to IP:port specified in PORT command sent by client (82.103.140.25:58627 in your case). Simplest way to fix this is to switch from 'Active' to 'Passive' FTP transfer mode. In case of 'pkg_add', which uses fetch(1) for file ...


2

One way to do this is to use m4 as a preprocessor that produces your final pf.conf. Or you can even break your pf.conf into parts and then have a simplistic "preprocessor" cat those parts > /etc/pf.conf.


2

M0n0wall snapshots (development version) are currently based on 8.2 and should support your NICs. You could also use a full install of FreeBSD with Webmin for the GUI. I haven't used Webmin on FreeBSD, so I can't attest to the completeness of the interface like pfSense or M0n0wall.


2

From the pf.conf(5) manpage: Translation options apply only to packets that pass through the specified interface, and if no interface is specified, translation is applied to packets on all interfaces. For instance, redirecting port 80 on an external interface to an internal web server will only work for connections originating from the outside. ...


2

You can do this through a slightly convoluted (but very easy to manage long-term, and pretty well-understood) adaptation of Netflow traffic monitoring (using OpenBSD's pflow support). Basically export netflow data for all your traffic, grab it with Flow-Tools, and feed it to something like JKFlow to parse (and graph/report on). There are also many other ...


2

Many if of the default settings you want to know can be found in the PF FAQ's chapter on Runtime Options



Only top voted, non community-wiki answers of a minimum length are eligible