Questions tagged [pf]
pf is the OpenBSD Packet Filter, a feature-rich IP-layer firewall used on FreeBSD, NetBSD, and Mac OS X, as well as in the pfSense open-source firewall appliance software.
143
questions
1
vote
1
answer
166
views
Port forward DNS using pf
On OpenBSD, I can successfully & transparently forward ports 80 and 443 to services running on custom, unprivileged ports using the following /etc/pf.conf:
tcp_pass = "{ 22 80 123 443 }"
...
- 810
0
votes
0
answers
70
views
pf rule for NATting multiple VPN interfaces, how to exclude two physical interfaces?
Situation: VPN server, hosting OpenVPN and L2TP connections. OpenVPN connections share a "utun" interface, one per OpenVPN server process. L2TP connections each get a unique "ppp" ...
- 21
0
votes
1
answer
409
views
PF firewall how to increase `max states per rule`
My firewall is hitting a problem related to max states per rule.
# pfctl -vvsi
Status: Enabled for 0 days 13:05:38 Debug: Urgent
Hostid: 0x6556c6a9
Checksum: ...
- 103
1
vote
1
answer
315
views
Simple OpenBSD NAT router not working
I'm toying around with using OpenBSD as a NAT router behind Starlink but efforts with the NAT are failing even in the simplest cases. I've probably simply been staring at it too long and need an ...
- 181
1
vote
0
answers
54
views
Mysterious/Unknown IPs keep getting whitelisted by spamd
I have an OpenBSD 7.1 mail server running OpenSMTPD with spamd.
I notice mysterious IP addresses in /var/log/maillog, such as:
smtp connected address=162.142.125.222 host=scanner-25.ch1.censys-scanner....
- 11
5
votes
2
answers
526
views
Why add "keep state" to pf firewall rules
If pf is a stateful firewall and keeps state by default, why do so many rulesets explicitly mention keep state?
- 365
1
vote
1
answer
181
views
While using pf on FreeBSD, do I need to explicitly specify both the inet and inet6 parameters?
Suppose I have a rule like
rdr on $ext_if inet proto tcp to port https -> $inf_if port $myhttps
This is to redirect incoming TCP packets on the https port to a specific internal IP/port. This is ...
- 365
1
vote
1
answer
426
views
403 Page recieved when accessing OpenBSD httpd page
I am writing a static webpage on an OpenBSD vm (here called example.com), and when I access the server with it's domain name over http I get httpd's 403 page, when I use telnet example.com 80 I get
...
1
vote
0
answers
2k
views
Redirecting traffic to a bridged ip and port using PF on MacOS
I am trying to redirect localhost traffic on specific port to bridged network ip
I am using following
echo "
rdr pass inet proto tcp from any to any port 9300 -> 192.168.64.29 port 9300
rdr ...
- 111
0
votes
1
answer
171
views
FreeBSD: How can I tune the lifetime for TCP/UDP for in kernel NAT?
There used to be these sysctls in older versions of FreeBSD, viz:
net.inet.ip.fw.dyn_ack_lifetime=3600
net.inet.ip.fw.dyn_udp_lifetime=15
now on FreeBSD 12 sysctl reports that these don't exist.
How ...
- 143
1
vote
2
answers
607
views
FreeBSD 13 PF blocking jail traffic
After upgrading my FreeBSD system from 12.2 to 13.0-p3 PF is blocking all traffic to my jails.
When disabling PF everything works fine (except from being unprotected ;))
I tried to figure out what ...
- 21
0
votes
0
answers
173
views
PF Nat over OpenVPN Client
I have FreeBSD 12.1-RELEASE router with 3 interfaces:
LAN HOME(192.168.22.)
LAN WORK(192.168.11.)
WAN(1.2.3.4)
My router connect to NordVPN over OpenVPN as a client (creates new TUN0 with address 10....
0
votes
1
answer
487
views
How to specify an IP range representing "any IP" within a Pfsense alias?
I've restricted the source IP of many rules to some alias, say Trusted_Sources.
Now, for some reason, I want to open all these rules to the world without manually modifying each individual rule.
How ...
- 41
0
votes
1
answer
112
views
freebsd packet filter match last digit of IP address
On my freebsd system I want to use port forwarding to distribute incoming traffic, based on the last digit of the source IP.
The following works on linux with iptables:
iptables -t nat -A ...
- 335
0
votes
0
answers
92
views
How come that with these packet filter rules, this rule triggers?
I have (amongst others) these rules in my pf setup:
block drop in log (user) proto udp from any to any port = 137
block drop in log (user) proto udp from any to any port = 138
block drop in log (user)...
- 171
0
votes
1
answer
1k
views
Setting DSCP value on specific outgoing traffic in OS X with pf
I want to set DSCP value on specific traffic coming out of an OS X machine.
I think the right way is to use pf, but I can't figure how to write the rule correctly.
I've tried something like this but ...
- 1
1
vote
0
answers
109
views
Share a VPN connection via a node in a LAN
I would like to share a VPN connection via a node in the same LAN.
The scheme below shows my network system.
LAN A: 10.44.247.0/24
|-* Router Aa: 10.44.247.1, ext XXX.XXX.XXX.XXX
|-* Node Ab: 10....
- 23
1
vote
0
answers
399
views
I fail to configure Pf of OpenBSD gateway
I have an OpenBSD server that I want to use as a gateway.
OBSD server has the following interfaces -
em5 (130...** ext.IP with internet connectivity)
em0 (internal IP - 172.16.0.0/17)
My default ...
- 167
2
votes
1
answer
267
views
Almost empty pf.conf still logs packets
I have an issue that my pf logs many packets that it's not supposed to log. I reproduced it with almost empty pf.conf:
set skip on lo
and it still logs some packets. I think that all those packets ...
- 261
0
votes
1
answer
148
views
FreeBSD and pf - packet filtering based on OpenVPN usernames
I have an OpenVPN server which authenticates the users using an Active Directory server. I need to limit the bandwidth of each user based on their usernames, and I also want to be able to do some ...
- 103
0
votes
2
answers
1k
views
PF blocking out Flags [FP.]
On a FreeBSD 12 server, I started to notice that pf is blocking out having Flags [FP.], the logs are flooded with something like this:
00:00:00.000004 rule 2/0(match): block out on bge0: 213.59.241....
- 558
0
votes
2
answers
665
views
FreeBSD-12.0 PF firewall default rule is blocking when more specific rule allowing is ignored
Our PF firewall contains this:
. . .
scrub in all fragment reassemble no-df max-mss 1440
### em1 ipv4 = 123.12.3.234
nat log on $ext_if \
from $net_nat \
...
- 337
4
votes
1
answer
1k
views
Changing PF rules on the fly to mitigate damage of DDoS (OpenBSD 6.4)
This is a two part question, really. Keep in mind that I am a developer not a system admin, but being the only employee in the company, I wear ALL the hats.
I have deployed my server with two ...
- 171
1
vote
1
answer
420
views
How to migrate Linux iptables scripts to OpenBSD/macOS pf
I am building a VPN server on macOS based on this instruction:
https://www.digitalocean.com/community/tutorials/how-to-set-up-an-ikev2-vpn-server-with-strongswan-on-ubuntu-18-04-2,
and stuck at ...
- 23
0
votes
2
answers
722
views
openbsd pf firewall - how can I tell what is being blocked?
I am in a dire situation. Our exchange server disks have failed. I can still use the application as the os disks are unaffected, and I need to do an emergency migration to office365.
We have an ...
1
vote
0
answers
714
views
(Mac OS PF) Redirect outgoing UDP traffice to specific ip:port
I'm having some trouble getting my head around how PF works in Mac OS. I have been doing a lot of research on the topic but just cannot find the solution (although I can find many other very similar ...
2
votes
0
answers
349
views
pfctl not relaying SYN, ACK packet after NAT
I am trying to relay SSH connections from LAN hosts to hosts beyond VPN.
Only one router host in the LAN has VPN connection to be reused by other hosts in LAN.
Below is pfctl configuration on the ...
- 21
2
votes
0
answers
683
views
Allowing Incoming Traffic over IPv6 with PF on FreeBSD
This is my current pf.conf on FreeBSD 11.1-RELEASE. It allows incoming connections from OpenVPN/UDP and SSH, as well as allows everything on the private/vpn networks (vtnet1 and tun0 respectively). ...
- 1,100
0
votes
1
answer
6k
views
PF firewall on FreeBSD for allowing SSH and OpenVPN Traffic
I'm trying to create a simple ansible template for the packet filter on FreeBSD 11.1-RELEASE. I have vtnet0 (public), vtnet1 (private, 10.10 address) and tun0 (openvpn, fully working/tested from a ...
- 1,100
0
votes
1
answer
890
views
Putting all blocked ips into a table
I would like to block all the incoming traffic for a specific port and to put the source ips of these blocked packets into a table... I don't know about a pf.conf solution, I guess I would use another ...
- 11
0
votes
1
answer
79
views
SSH into a jail takes so long
I have only one ip address and so I get to my jail through NAT.
SSH to the host is lightning-fast but SSH to the jail is awfully long... Like 20 seconds between ssh command and prompt for public key ...
- 11
0
votes
0
answers
62
views
Real meaning of "in" and "out" regarding a virtual network
I am confused, I thought I understand those basics but now I'm not quite sure any more...
Considering that conf :
cloned_interfaces="lo7"
ifconfig_bce0="dhcp"
ifconfig_bce0_alias0="inet 192.168.0.1/...
- 11
1
vote
1
answer
671
views
Why is there non-127.x.x.x traffic on my loopback device?
I've got an issue which caused me quite a bit of a headache and found the solution, but I cannot understand why the problem was happening in the first place.
I've got an nginx reverse proxy which is ...
- 159
1
vote
1
answer
1k
views
PF based gateway firewall for Openbsd 6.0
Currenly I am looking to create an OpenBSD 6.0 pf based gateway. Based on what I read in the pf manual pages and OpenBSD pf FAQ, and some examples on the internet, I was able to configure a firewall. ...
1
vote
1
answer
423
views
PF temporary reroute to different IP
I have a FreeBSD host that serves as an entry point to additional systems on an internal network. As such I have pf configured to redirect incoming traffic on certain ports (say, port 5000) to the ...
- 113
2
votes
0
answers
778
views
Configuring PF to route between routing domains
I've got an OpenBSD 6.0 box running as a router / firewall. It's got three physical network connections and one GRE tunnel:
em0: Internet (routing domain 0)
em1: Internal LAN private IPs (routing ...
- 123
1
vote
0
answers
393
views
pf on os x server 10.10 doesn't block addresses added to a table
I'm trying to understand the issue with pf on OS X 10.10 El Capitan.
I have installed sshguard and try to make it work by adding
table <sshguard> persist
block in quick proto tcp from <...
- 142
1
vote
2
answers
2k
views
Block DNS query using pfctl
I am trying to create rule to allow DNS queries (port 53) to only 8.8.8.8 server (Google DNS). DNS queries to all other servers should not succeed.
I added the following lines to /etc/pf.conf file
...
- 11
0
votes
2
answers
681
views
pf shortcuts for block quick
Looking at https://www.openbsd.org/faq/pf/shortcuts.html it's not clear to me if these are the same-
block quick from <bruteforce>
and-
block in quick from <bruteforce> to any
block out ...
- 165
2
votes
1
answer
3k
views
All IPv6 traffic blocked by pf
The following pf.conf (FreeBSD 10.3) appears to be blocking all IPv6 traffic and I can't work out why.
tcp_inbound = "{ ssh, domain, http, https }"
tcp_outbound = "{ domain, http, https, imaps, smtps ...
- 181
0
votes
1
answer
1k
views
Restrict client IP address on OpenVPN using TAP interface
I've set up an OpenVPN + PF setup on a FreeBSD 10.3 server.
Clients to my VPN include administrators, which should have full access to the network and untrusted users who should ONLY be able to ...
3
votes
3
answers
18k
views
Redirecting traffic to a specific address and port using PF on MacOS
I want to pentest a mobile application. To do so, I want to intercept all WiFi traffic and forward it to Burp, which runs in a VM.
I enabled "Internet Sharing" on my Macbook so my phone now connects ...
- 196
2
votes
1
answer
2k
views
Can't access server on loopback address, only on private address
I am running a rails web app server bound to 0.0.0.0 on port 80 like so:
sudo rails s --port=80 --bind=0.0.0.0
I can access it at my private address http://192.168.0.13/, normally I can access at ...
- 129
1
vote
0
answers
701
views
Need to restart PF under OSX till it gets effective
is anybody here familiar with the use of PF under OSX? I'm using PF in order to force all the traffic on my MacBook going thru a VPN. In order to do so, I'm using the following pf.conf:
wifi=en0
...
- 191
0
votes
1
answer
3k
views
DNS lookup to localhost gives network error
I am running a recursive DNS server on Unbound in a jail on FreeBSD with pf as a firewall.
Running drill @xxx.xxx.xxx.xxx example.com (where xxx.xxx.xxx.xxx is the servers IP) on my local machine ...
1
vote
0
answers
894
views
Using PF under OSX but skipping local interface
I'm using PF under OSX to force the OS the make all external connections via a VPN to Ipredator. However, as soon as I start PF all local connections are blocked even though I thought I told PF to ...
- 191
2
votes
2
answers
474
views
Layer 3 routing based on HTTP packet content
I'm running a HTTP proxy service and want to route traffic to various Layer 3 TUNs based on the contents of HTTP packets (e.g. HTTP headers).
I'm using BSD and Linux to do this but it doesn't look ...
- 2,202
2
votes
2
answers
2k
views
Redirection of pfctl on OSX gets error
I want all my traffics are redirected to SOCKS proxy on 127.0.0.1:1080. I added the rule below to the end of /etc/pf.conf according to this tutorial:
pass on en3 proto tcp from any to any rdr-to 127....
- 263
6
votes
0
answers
1k
views
pfSense Internal Traffic Policy Based Routing
What is the current and correct way to apply policy based routing to pfSense internal traffic (originating from the firewall itself)? Creating a floating rule with the WAN interfaces selected, ...
- 536
1
vote
1
answer
9k
views
traffic shaping on OSX 10.10 with pfctl and dnctl
I am trying to do traffic shaping (throttling) on Mac OS X 10.10 via pfctl and dnctl.
I have implemented a simple test server and client with netcat (nc) and a synthetic random payload file to verify ...
- 283