Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [pf]

pf is the OpenBSD Packet Filter, a feature-rich IP-layer firewall used on FreeBSD, NetBSD, and Mac OS X, as well as in the pfSense open-source firewall appliance software.

0
votes
0answers
20 views

PF source address masking similar to dummynet

I'm looking for a way to implementing traffic shaping in a way that dynamically shares a connection among all users while preventing any one user from monopolizing the bandwidth. Ideally all users who ...
1
vote
1answer
27 views

Changing PF rules on the fly to mitigate damage of DDoS (OpenBSD 6.4)

This is a two part question, really. Keep in mind that I am a developer not a system admin, but being the only employee in the company, I wear ALL the hats. I have deployed my server with two ...
0
votes
0answers
35 views

How to migrate Linux iptables scripts to OpenBSD/macOS pf

I am building a VPN server on macOS based on this instruction: https://www.digitalocean.com/community/tutorials/how-to-set-up-an-ikev2-vpn-server-with-strongswan-on-ubuntu-18-04-2, and stuck at ...
0
votes
0answers
13 views

use of tables in anchor in mac OS

I am trying to use table in anchor, but it is not applying the rules. 1) I have created /etc/pf.rules/pfssh.rule. The below 2 rules I have added in the file table <sagar1> persist block out ...
0
votes
0answers
43 views

Forward whole ip range to another ip range with pf on mac

I need to forward all traffic to 172.16.0.x to the ip range 10.78.7.x I tried using pf.conf for that, but it seems my configuration does not get applied at all. What I tried was: echo " rdr pass ...
0
votes
0answers
64 views

VPN tunnel and reverse proxy for a single host and two specific ports

In light of all the restrictions flaring up in the world we'd like to be prepared to circumvent IP/website blocks which we have no control on. There's a certain website destination.com which has two ...
0
votes
1answer
84 views

openbsd pf firewall - how can I tell what is being blocked?

I am in a dire situation. Our exchange server disks have failed. I can still use the application as the os disks are unaffected, and I need to do an emergency migration to office365. We have an ...
0
votes
0answers
43 views

Firewall WAN traffic stuck in a loop at gateway

I installed OPNsense on my firewall (firewall-new), set igb0 to WAN, connected it to my ISP's box and assigned the IP and gateway provided by my ISP. firewall-new can ping hosts on the internet such ...
1
vote
0answers
193 views

(Mac OS PF) Redirect outgoing UDP traffice to specific ip:port

I'm having some trouble getting my head around how PF works in Mac OS. I have been doing a lot of research on the topic but just cannot find the solution (although I can find many other very similar ...
2
votes
0answers
76 views

pfctl not relaying SYN, ACK packet after NAT

I am trying to relay SSH connections from LAN hosts to hosts beyond VPN. Only one router host in the LAN has VPN connection to be reused by other hosts in LAN. Below is pfctl configuration on the ...
2
votes
0answers
210 views

Allowing Incoming Traffic over IPv6 with PF on FreeBSD

This is my current pf.conf on FreeBSD 11.1-RELEASE. It allows incoming connections from OpenVPN/UDP and SSH, as well as allows everything on the private/vpn networks (vtnet1 and tun0 respectively). ...
0
votes
1answer
1k views

PF firewall on FreeBSD for allowing SSH and OpenVPN Traffic

I'm trying to create a simple ansible template for the packet filter on FreeBSD 11.1-RELEASE. I have vtnet0 (public), vtnet1 (private, 10.10 address) and tun0 (openvpn, fully working/tested from a ...
0
votes
1answer
195 views

Putting all blocked ips into a table

I would like to block all the incoming traffic for a specific port and to put the source ips of these blocked packets into a table... I don't know about a pf.conf solution, I guess I would use another ...
0
votes
1answer
48 views

SSH into a jail takes so long

I have only one ip address and so I get to my jail through NAT. SSH to the host is lightning-fast but SSH to the jail is awfully long... Like 20 seconds between ssh command and prompt for public key ...
0
votes
0answers
39 views

Real meaning of “in” and “out” regarding a virtual network

I am confused, I thought I understand those basics but now I'm not quite sure any more... Considering that conf : cloned_interfaces="lo7" ifconfig_bce0="dhcp" ifconfig_bce0_alias0="inet 192.168.0.1/...
1
vote
1answer
309 views

Why is there non-127.x.x.x traffic on my loopback device?

I've got an issue which caused me quite a bit of a headache and found the solution, but I cannot understand why the problem was happening in the first place. I've got an nginx reverse proxy which is ...
1
vote
1answer
961 views

PF based gateway firewall for Openbsd 6.0

Currenly I am looking to create an OpenBSD 6.0 pf based gateway. Based on what I read in the pf manual pages and OpenBSD pf FAQ, and some examples on the internet, I was able to configure a firewall. ...
1
vote
1answer
137 views

PF temporary reroute to different IP

I have a FreeBSD host that serves as an entry point to additional systems on an internal network. As such I have pf configured to redirect incoming traffic on certain ports (say, port 5000) to the ...
2
votes
0answers
358 views

Configuring PF to route between routing domains

I've got an OpenBSD 6.0 box running as a router / firewall. It's got three physical network connections and one GRE tunnel: em0: Internet (routing domain 0) em1: Internal LAN private IPs (routing ...
1
vote
0answers
233 views

pf on os x server 10.10 doesn't block addresses added to a table

I'm trying to understand the issue with pf on OS X 10.10 El Capitan. I have installed sshguard and try to make it work by adding table <sshguard> persist block in quick proto tcp from <...
1
vote
2answers
360 views

Block DNS query using pfctl

I am trying to create rule to allow DNS queries (port 53) to only 8.8.8.8 server (Google DNS). DNS queries to all other servers should not succeed. I added the following lines to /etc/pf.conf file ...
0
votes
1answer
230 views

pf shortcuts for block quick

Looking at https://www.openbsd.org/faq/pf/shortcuts.html it's not clear to me if these are the same- block quick from <bruteforce> and- block in quick from <bruteforce> to any block out ...
2
votes
1answer
1k views

All IPv6 traffic blocked by pf

The following pf.conf (FreeBSD 10.3) appears to be blocking all IPv6 traffic and I can't work out why. tcp_inbound = "{ ssh, domain, http, https }" tcp_outbound = "{ domain, http, https, imaps, smtps ...
0
votes
1answer
446 views

Restrict client IP address on OpenVPN using TAP interface

I've set up an OpenVPN + PF setup on a FreeBSD 10.3 server. Clients to my VPN include administrators, which should have full access to the network and untrusted users who should ONLY be able to ...
0
votes
0answers
137 views

PF firewall rules - not working

I have looked around, and attempted various configurations for PF, but every time I attempt to enable PF, everything gets blocked. Any help with the rule set I have in place would be appreciated: I ...
2
votes
3answers
5k views

Redirecting traffic to a specific address and port using PF on MacOS

I want to pentest a mobile application. To do so, I want to intercept all WiFi traffic and forward it to Burp, which runs in a VM. I enabled "Internet Sharing" on my Macbook so my phone now connects ...
2
votes
1answer
565 views

Can't access server on loopback address, only on private address

I am running a rails web app server bound to 0.0.0.0 on port 80 like so: sudo rails s --port=80 --bind=0.0.0.0 I can access it at my private address http://192.168.0.13/, normally I can access at ...
1
vote
0answers
247 views

Need to restart PF under OSX till it gets effective

is anybody here familiar with the use of PF under OSX? I'm using PF in order to force all the traffic on my MacBook going thru a VPN. In order to do so, I'm using the following pf.conf: wifi=en0 ...
0
votes
1answer
1k views

DNS lookup to localhost gives network error

I am running a recursive DNS server on Unbound in a jail on FreeBSD with pf as a firewall. Running drill @xxx.xxx.xxx.xxx example.com (where xxx.xxx.xxx.xxx is the servers IP) on my local machine ...
1
vote
0answers
463 views

Using PF under OSX but skipping local interface

I'm using PF under OSX to force the OS the make all external connections via a VPN to Ipredator. However, as soon as I start PF all local connections are blocked even though I thought I told PF to ...
2
votes
2answers
336 views

Layer 3 routing based on HTTP packet content

I'm running a HTTP proxy service and want to route traffic to various Layer 3 TUNs based on the contents of HTTP packets (e.g. HTTP headers). I'm using BSD and Linux to do this but it doesn't look ...
2
votes
1answer
796 views

Redirection of pfctl on OSX gets error

I want all my traffics are redirected to SOCKS proxy on 127.0.0.1:1080. I added the rule below to the end of /etc/pf.conf according to this tutorial: pass on en3 proto tcp from any to any rdr-to 127....
5
votes
0answers
917 views

pfSense Internal Traffic Policy Based Routing

What is the current and correct way to apply policy based routing to pfSense internal traffic (originating from the firewall itself)? Creating a floating rule with the WAN interfaces selected, ...
1
vote
1answer
5k views

traffic shaping on OSX 10.10 with pfctl and dnctl

I am trying to do traffic shaping (throttling) on Mac OS X 10.10 via pfctl and dnctl. I have implemented a simple test server and client with netcat (nc) and a synthetic random payload file to verify ...
2
votes
1answer
2k views

pfSense can't access https website

I have just installed pfSense on a PC Engines APU1D4 to evaluate as an alternative to a Soekris 5501 + OpenBSD based setup, I have a PPPoE WAN configuration. The pf rules, NAT and PPPoE ...
0
votes
1answer
128 views

apache / mysql unable to connect jails with PF firewall

I have setup two jail environments on FreeBSD11 root@ns312773:/etc # jls JID IP Address Hostname Path 1 10.6.6.6 www /usr/jails/...
-1
votes
1answer
330 views

pf firewall server configuration

I am trying to configure a fire wall for a server that host http, smtp and ssh on a custom port. When I initialize pf, I get an error at the command line: No ALTQ support in kernel and my ssh ...
1
vote
0answers
892 views

Openbsd 5.7: IPv6 advertisement not working

--context-- I have a Sokeris with 8 interfaces: em0 is connected to a bridge router (ISP) and em2 is connected to my DMZ network (web servers). I got from my ISP a /56 prefix and 2 DNS IPs but no ...
5
votes
1answer
5k views

pf (Mac OS X) rule to redirect all traffic to a specific ip/port

I'm trying to recreate this iptables setup (from https://github.com/darkk/redsocks) with pf: iptables -t nat -A REDSOCKS -p tcp -d 10.0.0.0/8 -j REDIRECT --to-ports 12345 iptables -t nat -A OUTPUT -p ...
3
votes
0answers
372 views

How to split traffic through two different network adapters based on TCP port in OS X

I have a scenario where we will be using a Mac to stream video content to an RTMP server. This RMTP service provides 2 ingest URLs so that you can upload the same video content twice and have ...
4
votes
1answer
440 views

PF vs -m of iptables

As you know, iptables has -m (match) such as : -m string -m state -m -iplimit and so on... My question: Does PF has similar features such as -m of iptables?
1
vote
1answer
2k views

openbsd pf squid transparent proxy using a bridge

I want to use OpenBSD 5.7 as a filtering bridge in front of my router, and as part of that run a transparent proxy (squid 3.5.1) to manage web access. I have set up the openbsd machine as a bridge, ...
1
vote
2answers
1k views

FreeBSD pf with NFS

I'm having trouble establishing new NFS connections when my pf is turned on. When I turn off pf on the server and client I'm able to mount with no trouble. I tried keep state and flags S/SA on the ...
3
votes
0answers
582 views

How to divert all OUTBOUND tcp traffic on port 1935 to localhost?

Mac OS X 10.10.3. I'm trying to use rtmpsrv. In order to do that, I have to redirect all outgoing tcp traffic on port 1935 to localhost. I tried: sudo sysctl -w net.inet.ip.forwarding=1 echo 'rdr ...
3
votes
3answers
1k views

How can one redirect to a new host all traffic destined for an old host?

We're moving a bunch of services, say from 1.2.3.4 to 5.6.7.8. In order to test that the new services are correctly configured, we'd like to redirect (to the new host) all traffic destined for the ...
1
vote
2answers
2k views

How to block MAC address in pf firewall

I want to block particular MAC address on PF firewall. I know PF firewall works on the Layer 3 i.e it operates on the IP addresses rather than MAC address.But is there any way to block the MAC address ...
2
votes
1answer
385 views

OpenBSD cannot set frag limit more than 6144

I am trying to : set limit frags 10000 and get following info: pfctl: cannot set 'frags' limit When i am trying to set it on 5000 everything works fine.
1
vote
1answer
1k views

Forwarding IP address using pf

I'm trying to forward an external IP address to another external IP address with pf. The equivalent iptables command would be iptables -t nat -A OUTPUT -d [ipaddress1] -j DNAT --to-destination [...
2
votes
1answer
340 views

PF redirect rule: how to limit the rule to specific user

I was trying to setup a PF redirect rule to force all web traffic from a specific user account to go through a web filter on a shared computer. With iptables, I can use --uid-owner option to limit ...
1
vote
1answer
732 views

Local transparent proxy OS X pf

I was trying to create local transparent proxy using this pf rules: rdr pass inet proto tcp from $Out to any port 80 -> 127.0.0.1 port 3129 pass out on $Out route-to lo0 inet proto tcp from $Out ...