Hot answers tagged

5

AFAIK, pf does not have the flexibility and modules available in iptables. iptables comes with really large number of modules that provide more match options and others that provide more targets. You can even develop your own module. This page provides some explanation regarding iptables development if you are interested.


3

No, there isn't. You know that it's trivial for people to change their MAC addresses, correct? Additionally, the instant a packet passes through a later 3 routing device, the Mac address information of the source machine is lost. So even if you did want to do something like this, it would only ever work for clients that are on the same L2 LAN as your ...


3

The message is normal because ALTQ is not compiled into the stock FreeBSD kernel. Unless you need to use ALTQ it doesn't matter. The start up of the firewall interrupts all current connections, including your ssh session, which stops responding. Just open another terminal and log in again. The original session will eventually time out. It's a good idea to ...


2

For BSD i would look into relayd(8) - its native to OpenBSD, but i believe FreeBSD has a port too. It is quite powerful and can do more than a few things (ex., proxy, load balancer, application gateway) including what you are asking. Read through man pages, particularly the 'Filter Rules' and 'Protocols' section: ...


2

The problem I see here is that you have to accept the TCP connection before you get to see the http request. So even if the system could use application level data it would not have that data at the time it needs to decide where the connection needs to go. I don't think there is much choice but to have a "reverse proxy" which terminates the TCP connection ...


2

After some more testing the pf rules, I briefly let all traffic pass and realized the mistake was that while I had pass quick on lo0 all in the pf.conf, the jail is running under lo1. I added pass quick on lo1 all and it works now. Also note that from within a jail, you should query the jail IP instead of localhost. So, in the jails resolv.conf: ...


2

So, I am likely misunderstanding but I think you may be confusing the iptables TPROXY and REDIRECT targets - but I don't think that's important. Ignoring that, you may still be able to realize your goal. Your frustration with the rdr pf rule is because only applies to incoming packets. According to a 2005 FreeBSD-pf mailinglist post, you may be able to ...


2

From the OpenBSD 5.3 upgrade guide: pfctl(8) will abort and fail to load the rule set if the 'frags' limit in pf.conf is higher than the kern.maxclusters sysctl This is to guard against allowing a system to run out of mbuf clusters. If it is not set, the new default is 25% of kern.maxclusters. If you increase kern.maxclusters, you will also raise the ...


1

To do that you have to tag the ethernet frame. (http://www.openbsd.org/faq/pf/tagging.html) Tagging can be performed at the Ethernet level if the machine doing the tagging/filtering is also acting as a bridge(4). By creating bridge(4) filter rules that use the tag keyword, PF can be made to filter based on the source or destination MAC address. Bridge(4) ...


1

Not getting far enough to be MTU-related. You're sending a SYN, getting a SYN ACK in reply, then RSTing the connection rather than completing the TCP handshake. Something is aborting the connection. That's an unusual circumstance, nothing about that suggests a specific cause. Looks like that capture reference point is your WAN, try the same on LAN to see ...



Only top voted, non community-wiki answers of a minimum length are eligible