6
votes
Accepted
All IPv6 traffic blocked by pf
By enabling logging I managed to work out that this is because the ICMP6 router solicitation was being blocked. Adding
pass proto ipv6-icmp from any to any
to the end of the file fixed the problem.
- 181
5
votes
Accepted
PF: Block all, but one subnet firewall rule?
its because its specifying a single ip, you need to write it with the subnet:
pass in from 111.111.0.0/16
man pf.conf should list a few methods of defining ranges and blocks. A side note, take care ...
- 693
5
votes
Accepted
PF vs -m of iptables
AFAIK, pf does not have the flexibility and modules available in iptables. iptables comes with really large number of modules that provide more match options and others that provide more targets. You ...
- 35.3k
4
votes
Accepted
pf (Mac OS X) rule to redirect all traffic to a specific ip/port
So, I am likely misunderstanding but I think you may be confusing the iptables TPROXY and REDIRECT targets - but I don't think that's important. Ignoring that, you may still be able to realize your ...
- 1,747
3
votes
Changing PF rules on the fly to mitigate damage of DDoS (OpenBSD 6.4)
Since no one has answered my question this is the pf configuration I ended up with. Specifically look at the line for setting cookies after the table is filled with 15% open tcp connections. SYN ...
- 171
3
votes
Accepted
PF firewall on FreeBSD for allowing SSH and OpenVPN Traffic
Setting up pf may be a bit of a hassle. You need to understand that pf treats all interfaces absolutely equally and there is no concept of packets originating on the box itself as there is in iptables ...
- 248
3
votes
pf firewall server configuration
The message is normal because ALTQ is not compiled into the stock FreeBSD kernel. Unless you need to use ALTQ it doesn't matter.
The start up of the firewall interrupts all current connections, ...
- 31
3
votes
How to block MAC address in pf firewall
To do that you have to tag the ethernet frame. (http://www.openbsd.org/faq/pf/tagging.html)
Tagging can be performed at the Ethernet level if the machine doing the tagging/filtering is also acting as ...
- 128
3
votes
How to block MAC address in pf firewall
No, there isn't.
You know that it's trivial for people to change their MAC addresses, correct? Additionally, the instant a packet passes through a later 3 routing device, the Mac address information ...
- 108k
3
votes
Accepted
Almost empty pf.conf still logs packets
I have no idea why am I receiving them
It's multicast traffic.
where can I read about those default match rules
Well, the thing in whole is partially documented but it's not that obviously ...
- 9,113
2
votes
Accepted
OpenBSD cannot set frag limit more than 6144
From the OpenBSD 5.3 upgrade guide:
pfctl(8) will abort and fail to load the rule set if the 'frags' limit in pf.conf is higher than the kern.maxclusters sysctl This is to guard against allowing a ...
- 7,588
2
votes
Forwarding IP address using pf
sysctl net.inet.ip.forwarding=1
This will just enable routing on your machine.
It could work if you would create a to allow any to the destination IP on the external interface (at least in theory) (...
- 485
2
votes
traffic shaping on OSX 10.10 with pfctl and dnctl
This is a script I used on El Capitan 10.11 with some success:
#!/bin/bash
# Reset dummynet to default config
dnctl -f flush
# Compose an addendum to the default config: creates a new anchor
(cat /...
- 121
2
votes
Accepted
DNS lookup to localhost gives network error
After some more testing the pf rules, I briefly let all traffic pass and realized the mistake was that while I had pass quick on lo0 all in the pf.conf, the jail is running under lo1.
I added pass ...
2
votes
Layer 3 routing based on HTTP packet content
The problem I see here is that you have to accept the TCP connection before you get to see the http request. So even if the system could use application level data it would not have that data at the ...
- 4,018
2
votes
Accepted
Layer 3 routing based on HTTP packet content
For BSD i would look into relayd(8) - its native to OpenBSD, but i believe FreeBSD has a port too. It is quite powerful and can do more than a few things (ex., proxy, load balancer, application ...
- 693
2
votes
Accepted
PF temporary reroute to different IP
The proper way to achieve this is to use table as a target for redirection. You can change content of table without reloading pf using pfctl. Just be aware that existing firewall states will keep ...
- 81
1
vote
pf shortcuts for block quick
They are not. To be short, only two rules in the middle are valid, others are just a noise. from requires a pair of addresses and a to keyword, and the last rule is just a total nonense.
- 7,954
1
vote
Putting all blocked ips into a table
I use this configuration on my servers, basically I have a table with trusted IPs and one table with ones that tries to bruteforce on SSH (few cases when it's open to the world).
Create a new file in ...
- 111
1
vote
Accepted
SSH into a jail takes so long
Yeay! Good point, Andrew! The jail couldn't resolve anything since I forgot to nat jail traffic! nat pass on $ext_if from $jail_network -> ($ext_if) was missing in pf.conf :-s
- 11
1
vote
Why is there non-127.x.x.x traffic on my loopback device?
After much research, the correct fix for my issue, instead of modifying the line I mentioned, was to remove that line completely and to add a set skip on lo0 in the Options block of the pf.conf (after ...
- 159
1
vote
PF based gateway firewall for Openbsd 6.0
Your first scrub rule is redundant - you repeat the same effect with the next two rules.
Make your specific block rules quick, or else they can be overwritten by later rules. (Default is the last ...
- 11
1
vote
Accepted
Redirecting traffic to a specific address and port using PF on MacOS
The following PF rules work:
nat on vmnet8 from bridge100:network to any -> (vmnet8)
rdr pass on bridge100 inet proto tcp from any to any -> 172.16.122.128 port 8080
This forwards all ...
- 196
1
vote
Redirecting traffic to a specific address and port using PF on MacOS
I guess, the problem is that you have not configured forwarding between 2 networks, (1) VM network (172.16.122.0/24) and (2) your LAN (192.168.2.0/24). To configure forwarding on your Mac, you ...
- 1,191
1
vote
Can't access server on loopback address, only on private address
127.0.0.1 is your loopback. It is always local to the machine you are on. Creating a VM means it is a new machine and it has its own internal 127.0.0.1. You could create 50 VM's and they're each ...
- 3,599
1
vote
Redirection of pfctl on OSX gets error
My operating system is OSX 10.11 El captain. Where am I wrong?
— In expectance that this syntax should work.
Pf's version ported to MacOS from its first emerging till to Mojave (including) is kept ...
- 9,113
1
vote
pfSense can't access https website
Not getting far enough to be MTU-related. You're sending a SYN, getting a SYN ACK in reply, then RSTing the connection rather than completing the TCP handshake. Something is aborting the connection. ...
- 2,927
1
vote
FreeBSD pf with NFS
NOTE: 192.168.1.9 is client and 14 is server and is work fine in my two server ....
Client pf.conf :
block all
pass in on em0 inet proto { tcp udp } from 192.168.1.14 to em0 port { sunrpc nfsd-...
- 596
1
vote
pf - redirect rule does not work
Have you checked your sshd listening addresses?
$ netstat -a | grep ssh
tcp4 0 0 *.ssh *.* LISTEN
tcp6 0 0 *.ssh *.* ...
- 868
1
vote
Enabling pf for transparent proxy on Mac OS X Mountain Lion
Did you try net.inet.ip.scopedroute=0? From http://lucumr.pocoo.org/2013/1/6/osx-wifi-proxy/:
Now currently if you finish that above setup you will notice that
nothing actually works. The cause ...
- 121
Only top scored, non community-wiki answers of a minimum length are eligible