Tag Info

Hot answers tagged

5

AFAIK, pf does not have the flexibility and modules available in iptables. iptables comes with really large number of modules that provide more match options and others that provide more targets. You can even develop your own module. This page provides some explanation regarding iptables development if you are interested.


3

No, there isn't. You know that it's trivial for people to change their MAC addresses, correct? Additionally, the instant a packet passes through a later 3 routing device, the Mac address information of the source machine is lost. So even if you did want to do something like this, it would only ever work for clients that are on the same L2 LAN as your ...


2

From the OpenBSD 5.3 upgrade guide: pfctl(8) will abort and fail to load the rule set if the 'frags' limit in pf.conf is higher than the kern.maxclusters sysctl This is to guard against allowing a system to run out of mbuf clusters. If it is not set, the new default is 25% of kern.maxclusters. If you increase kern.maxclusters, you will also raise the ...


1

To do that you have to tag the ethernet frame. (http://www.openbsd.org/faq/pf/tagging.html) Tagging can be performed at the Ethernet level if the machine doing the tagging/filtering is also acting as a bridge(4). By creating bridge(4) filter rules that use the tag keyword, PF can be made to filter based on the source or destination MAC address. Bridge(4) ...


1

The message is normal because ALTQ is not compiled into the stock FreeBSD kernel. Unless you need to use ALTQ it doesn't matter. The start up of the firewall interrupts all current connections, including your ssh session, which stops responding. Just open another terminal and log in again. The original session will eventually time out. It's a good idea to ...


1

Not getting far enough to be MTU-related. You're sending a SYN, getting a SYN ACK in reply, then RSTing the connection rather than completing the TCP handshake. Something is aborting the connection. That's an unusual circumstance, nothing about that suggests a specific cause. Looks like that capture reference point is your WAN, try the same on LAN to see ...



Only top voted, non community-wiki answers of a minimum length are eligible