6
votes
Accepted
All IPv6 traffic blocked by pf
By enabling logging I managed to work out that this is because the ICMP6 router solicitation was being blocked. Adding
pass proto ipv6-icmp from any to any
to the end of the file fixed the problem.
- 181
5
votes
Accepted
PF vs -m of iptables
AFAIK, pf does not have the flexibility and modules available in iptables. iptables comes with really large number of modules that provide more match options and others that provide more targets. You ...
- 36.4k
4
votes
Accepted
pf (Mac OS X) rule to redirect all traffic to a specific ip/port
So, I am likely misunderstanding but I think you may be confusing the iptables TPROXY and REDIRECT targets - but I don't think that's important. Ignoring that, you may still be able to realize your ...
- 1,747
3
votes
Accepted
While using pf on FreeBSD, do I need to explicitly specify both the inet and inet6 parameters?
If we take it for granted that the first rule looks like in the question, you would indeed need a separate rule for inet6 to also do the same for IPv6.
However, if the rules are otherwise identical, ...
- 34.6k
3
votes
Accepted
Almost empty pf.conf still logs packets
I have no idea why am I receiving them
It's multicast traffic.
where can I read about those default match rules
Well, the thing in whole is partially documented but it's not that obviously ...
- 9,371
3
votes
Changing PF rules on the fly to mitigate damage of DDoS (OpenBSD 6.4)
Since no one has answered my question this is the pf configuration I ended up with. Specifically look at the line for setting cookies after the table is filled with 15% open tcp connections. SYN ...
- 171
3
votes
Accepted
PF firewall on FreeBSD for allowing SSH and OpenVPN Traffic
Setting up pf may be a bit of a hassle. You need to understand that pf treats all interfaces absolutely equally and there is no concept of packets originating on the box itself as there is in iptables ...
- 248
3
votes
pf firewall server configuration
The message is normal because ALTQ is not compiled into the stock FreeBSD kernel. Unless you need to use ALTQ it doesn't matter.
The start up of the firewall interrupts all current connections, ...
- 31
2
votes
Accepted
DNS lookup to localhost gives network error
After some more testing the pf rules, I briefly let all traffic pass and realized the mistake was that while I had pass quick on lo0 all in the pf.conf, the jail is running under lo1.
I added pass ...
2
votes
Layer 3 routing based on HTTP packet content
The problem I see here is that you have to accept the TCP connection before you get to see the http request. So even if the system could use application level data it would not have that data at the ...
- 4,191
2
votes
Accepted
Layer 3 routing based on HTTP packet content
For BSD i would look into relayd(8) - its native to OpenBSD, but i believe FreeBSD has a port too. It is quite powerful and can do more than a few things (ex., proxy, load balancer, application ...
- 723
2
votes
traffic shaping on OSX 10.10 with pfctl and dnctl
This is a script I used on El Capitan 10.11 with some success:
#!/bin/bash
# Reset dummynet to default config
dnctl -f flush
# Compose an addendum to the default config: creates a new anchor
(cat /...
- 121
2
votes
Accepted
PF temporary reroute to different IP
The proper way to achieve this is to use table as a target for redirection. You can change content of table without reloading pf using pfctl. Just be aware that existing firewall states will keep ...
- 81
2
votes
Why add "keep state" to pf firewall rules
To complement Paul's answer - I looked this up from the OpenBSD pf documentation:
The keep state option is the implicit default for all filter rules. Despite this, when specifying stateful options, ...
- 345
2
votes
Why add "keep state" to pf firewall rules
Without examples or asking the people who create the configurations, at least two reasons might be copying known working configurations without understanding the configurations or a partial ...
- 2,989
1
vote
Accepted
PF firewall how to increase `max states per rule`
Have you tried this?
PF.CONF(5) File Formats Manual PF.CONF(5)
…
STATEFUL TRACKING OPTIONS
A number of options related to stateful tracking can be ...
- 9,371
1
vote
Putting all blocked ips into a table
I use this configuration on my servers, basically I have a table with trusted IPs and one table with ones that tries to bruteforce on SSH (few cases when it's open to the world).
Create a new file in ...
- 111
1
vote
Accepted
SSH into a jail takes so long
Yeay! Good point, Andrew! The jail couldn't resolve anything since I forgot to nat jail traffic! nat pass on $ext_if from $jail_network -> ($ext_if) was missing in pf.conf :-s
- 11
1
vote
Why is there non-127.x.x.x traffic on my loopback device?
After much research, the correct fix for my issue, instead of modifying the line I mentioned, was to remove that line completely and to add a set skip on lo0 in the Options block of the pf.conf (after ...
- 159
1
vote
PF based gateway firewall for Openbsd 6.0
Your first scrub rule is redundant - you repeat the same effect with the next two rules.
Make your specific block rules quick, or else they can be overwritten by later rules. (Default is the last ...
- 11
1
vote
pf shortcuts for block quick
They are not. To be short, only two rules in the middle are valid, others are just a noise. from requires a pair of addresses and a to keyword, and the last rule is just a total nonense.
- 8,578
1
vote
pfSense can't access https website
Not getting far enough to be MTU-related. You're sending a SYN, getting a SYN ACK in reply, then RSTing the connection rather than completing the TCP handshake. Something is aborting the connection. ...
- 2,978
1
vote
Accepted
Redirecting traffic to a specific address and port using PF on MacOS
The following PF rules work:
nat on vmnet8 from bridge100:network to any -> (vmnet8)
rdr pass on bridge100 inet proto tcp from any to any -> 172.16.122.128 port 8080
This forwards all ...
- 196
1
vote
Redirecting traffic to a specific address and port using PF on MacOS
I guess, the problem is that you have not configured forwarding between 2 networks, (1) VM network (172.16.122.0/24) and (2) your LAN (192.168.2.0/24). To configure forwarding on your Mac, you ...
- 1,201
1
vote
Can't access server on loopback address, only on private address
127.0.0.1 is your loopback. It is always local to the machine you are on. Creating a VM means it is a new machine and it has its own internal 127.0.0.1. You could create 50 VM's and they're each ...
- 3,773
1
vote
Redirection of pfctl on OSX gets error
My operating system is OSX 10.11 El captain. Where am I wrong?
— In expectance that this syntax should work.
Pf's version ported to MacOS from its first emerging till to Mojave (including) is kept ...
- 9,371
1
vote
FreeBSD pf with NFS
NOTE: 192.168.1.9 is client and 14 is server and is work fine in my two server ....
Client pf.conf :
block all
pass in on em0 inet proto { tcp udp } from 192.168.1.14 to em0 port { sunrpc nfsd-...
- 602
1
vote
How can one redirect to a new host all traffic destined for an old host?
If the services you are accessing are all accessed by name then I'd just create a host entry with in the hosts file on your dev machines.
For example, if your machine was called myserver and resolved ...
- 14.4k
Only top scored, non community-wiki answers of a minimum length are eligible