Hot answers tagged pf
The "extra" options were deprecated by OpenBSD over 9 years ago and removed in pfctl revision 1.143 (Mar 23, 2010) with the following comments: remove -A, -O, -R and -T load the partial loading of a ruleset (leaving ancors aside) is wrong and conflicts with the general idea of how pf works. last not least it breaks with the optimizer generating ...
You can do it with PF as well. However, rdr only accepts incoming packets. Thus, you have to first route those packets to lo0, then add a rdr rule there (which will catch them as they will be routed in from "somewhere") to send them to your local ssh server. The order is necessarily rdr stuff, then filter stuff (like pass), but chronologically the 2nd rule ...
From the OpenBSD pf docs: All pass rules automatically create a state entry when a packet matches the rule. This can be explicitly disabled by using the no state option. So you're already stateful. And to clarify, FreeBSD occasionally ports pf over from OpenBSD, so their documentation applies for core features.
You need to use sudo to run pfctl from your web application and you need to add the "apache" user to the sudoers file with the rights to run pfctl without asking for a password. NOTE: To modify your sudoers file use the command visudo as root, or an account with elevated privileges to do so. You might also not want to use the obsolete mod_python way of ...
This is because you don't block outgoing traffic by default on your localnet. Try using something along those lines: block out from $localnet to any pass inet proto tcp from $localnet to port $client_out_tcp pass inet proto tcp from $localnet to port $client_out_udp
Only top voted, non community-wiki answers of a minimum length are eligible