Tag Info

Hot answers tagged

40

Help! My house is on fire! Lets burn down the fire station to get their attention!


22

Doing as you propose is unethical, potentially illegal and technically pointless. Redirecting your DDoS traffic to another site makes you as complicit in the attack as the people attacking you. You do not like dealing with the mess that such an attack causes; why do you think that the sysadmin at any other site will like it more. How would you feel if ...


8

Incredibly poor idea. pf is not magic - all that setting it to forward DDoS traffic to the FBI will accomplish is make your machine attempt to perform a haphazard DoS against the FBI's web server.


6

pfSense 2.0 has back ported Intel drivers from FreeBSD 9 so that will definitely work, and is generally the preferred release for new deployments anyway. m0n0wall snapshot versions should work too.


5

Try this on the shell to disable PF temporarily: pfctl -d Then once you are able to login and create the rules turn PF back on with: pfctl -e I've had to do exactly what you describe before when I locked myself out remotely.


5

Sorry, what you're asking for is impossible -- IP traffic (and an IP firewall) only knows IP addresses - it knows nothing of hostnames. You can only have one process listening to a specific port on a specific IP address. Virtual hosts for websites work because the web server receives the hostname in an HTTP header (see ...


4

In FreeBSD the firewalls (IPF, IPFW, and PF) sit between the Device Driver and the IP Stack. Routing is part of the IP Stack.


4

its because its specifying a single ip, you need to write it with the subnet: pass in from 111.111.0.0/16 man pf.conf should list a few methods of defining ranges and blocks. A side note, take care to ensure there are no drop quick kind of rules above your pass, and no rules below that could accidently match and block your packets.


4

The source-track option does apply per-rule, so you are not restricting "Google to X req/day", you are restricting each individual address to that limit. I give you two solutions here. One is simple and approximate, the other is harder and sharper. Solution 1 Transform the condition so as to match all servers of interest in one rule. The simplest approach ...


4

To list all values, try pfctl -s all To list only the limits you requested, try pfctl -s memory To list only the timeouts you requested, try pfctl -s timeouts Out of the curiosity: Are you sure you need to adjust those values? Are you sure you can outsmart the default values, if merely listing the values is not familiar to you?


4

Try pfctl -s queue -v or pfctl -s queue -v -v for continuous output.


4

First, you should configure the LAN NIC to an address from the routed(!) /64; the ::1 is an ideal candidate. Then, fire up radvd on the LAN interface---it should not need any configuration. PF doesn't play any role in it, or rather, make sure that it doesn't get in the way.


4

Just wanted to update on this in case anyone runs in to the same problem. Essentially it comes down to the state rules in Pf. By default Pf keeps state, and uses S/SA as a mask. However, it seems that the NFS server implementation on OS X attempts to start a conversation back to the client using a non-standard set of flags. This was causing it to fail ...


4

If I remember correctly: PF has a special interface for monitoring purposes (pflog). You might wanna consult the manpage for it.


4

AFAIK, pf does not have the flexibility and modules available in iptables. iptables comes with really large number of modules that provide more match options and others that provide more targets. You can even develop your own module. This page provides some explanation regarding iptables development if you are interested.


3

you can listen multiple times on the same pflog0 and use bpf filters to split them up pflogd0 -f /var/log/pf.blocked action block pflogd0 -f /var/log/pf.passed action pass pflogd0 -f /var/log/pf.rule.15 rulenum 15 pflogd0 -f /var/log/pf.fxp0 on fxp0 (c) Mike Frantzen PS. right syntax is ifconfig pflog1 create


3

AFAIC, pf can't do this. You can use ipfw's iplen option: iplen len-list Matches IP packets whose total length, including header and data, is in the set len-list, which is either a single value or a list of values or ranges specified in the same way as ports.


3

No, there isn't. You know that it's trivial for people to change their MAC addresses, correct? Additionally, the instant a packet passes through a later 3 routing device, the Mac address information of the source machine is lost. So even if you did want to do something like this, it would only ever work for clients that are on the same L2 LAN as your ...


3

pfsense is a firewall OS and is based on FreeBSD And PF and would offer you a fully web based GUI. for more information check out http://www.pfsense.org


3

You can do it with PF as well. However, rdr only accepts incoming packets. Thus, you have to first route those packets to lo0, then add a rdr rule there (which will catch them as they will be routed in from "somewhere") to send them to your local ssh server. The order is necessarily rdr stuff, then filter stuff (like pass), but chronologically the 2nd rule ...


3

The "extra" options were deprecated by OpenBSD over 9 years ago and removed in pfctl revision 1.143 (Mar 23, 2010) with the following comments: remove -A, -O, -R and -T load the partial loading of a ruleset (leaving ancors aside) is wrong and conflicts with the general idea of how pf works. last not least it breaks with the optimizer generating ...


3

According to http://lists.freebsd.org/pipermail/freebsd-pf/2008-October/004826.html you can't load queues into anchors as I'm trying to do. You have to load the queue rules in to the main pf.conf file and load only the filter rules that assign traffic to the queue(s) into the anchor.


2

Change: rdr on $if_ext inet proto tcp from $net_local to any port {80, 443} -> 127.0.0.1 port 8080 to: rdr on $if_int inet proto tcp from $net_local to any port {80, 443} -> 127.0.0.1 port 8080


2

The 9.0 branch seems to be particularly sensitive to odd configurations where TCP Segmentation Offload is involved. This can be "corrected" by disabling TSO: ifconfig em0 -tso


2

Many if of the default settings you want to know can be found in the PF FAQ's chapter on Runtime Options


2

If i remember well, you can't. You can only filter mac address when you do it on a bridge if


2

As mandrake pointed out you can't filter by MAC address directly in PF (it's an IP packet filter, it knows not of this "ethernet" thing). What you CAN do, if your system is acting as a bridge, is tag packets based on MAC address, and then filter based on the tag. From the pf FAQ: Tagging Ethernet Frames Tagging can be performed at the Ethernet ...


2

If you are using a pfSense installation, use the tools pfSense offers to make changes. You can go and poke around on the command line, but you shouldn't unless you absolutely need to, and you can make the changes almost as quickly through their GUI as you could on the command line. A better solution in your case might be to set up a VPN connection and put ...


2

One way to do this is to use m4 as a preprocessor that produces your final pf.conf. Or you can even break your pf.conf into parts and then have a simplistic "preprocessor" cat those parts > /etc/pf.conf.


2

To cover the obvious - you are running the ftp-proxy daemon, and your securelevel is <= 1, right? (see also the ftp-proxy(8) manpage which is probably more helpful than I will be - FTP and I don't get along) In my experience FTP is horribly broken behind any halfway decent firewall -- typically I give up and allow all outbound traffic (& stateful ...



Only top voted, non community-wiki answers of a minimum length are eligible