Hot answers tagged

6 votes
Accepted

All IPv6 traffic blocked by pf

By enabling logging I managed to work out that this is because the ICMP6 router solicitation was being blocked. Adding pass proto ipv6-icmp from any to any to the end of the file fixed the problem.
dpk's user avatar
  • 181
5 votes
Accepted

PF vs -m of iptables

AFAIK, pf does not have the flexibility and modules available in iptables. iptables comes with really large number of modules that provide more match options and others that provide more targets. You ...
Khaled's user avatar
  • 36.4k
4 votes
Accepted

pf (Mac OS X) rule to redirect all traffic to a specific ip/port

So, I am likely misunderstanding but I think you may be confusing the iptables TPROXY and REDIRECT targets - but I don't think that's important. Ignoring that, you may still be able to realize your ...
etherfish's user avatar
  • 1,747
3 votes
Accepted

While using pf on FreeBSD, do I need to explicitly specify both the inet and inet6 parameters?

If we take it for granted that the first rule looks like in the question, you would indeed need a separate rule for inet6 to also do the same for IPv6. However, if the rules are otherwise identical, ...
Håkan Lindqvist's user avatar
3 votes
Accepted

Almost empty pf.conf still logs packets

I have no idea why am I receiving them It's multicast traffic. where can I read about those default match rules Well, the thing in whole is partially documented but it's not that obviously ...
poige's user avatar
  • 9,371
3 votes

Changing PF rules on the fly to mitigate damage of DDoS (OpenBSD 6.4)

Since no one has answered my question this is the pf configuration I ended up with. Specifically look at the line for setting cookies after the table is filled with 15% open tcp connections. SYN ...
Miguel's user avatar
  • 171
3 votes
Accepted

PF firewall on FreeBSD for allowing SSH and OpenVPN Traffic

Setting up pf may be a bit of a hassle. You need to understand that pf treats all interfaces absolutely equally and there is no concept of packets originating on the box itself as there is in iptables ...
Tom Trebicky's user avatar
3 votes

pf firewall server configuration

The message is normal because ALTQ is not compiled into the stock FreeBSD kernel. Unless you need to use ALTQ it doesn't matter. The start up of the firewall interrupts all current connections, ...
kjpetrie's user avatar
2 votes
Accepted

DNS lookup to localhost gives network error

After some more testing the pf rules, I briefly let all traffic pass and realized the mistake was that while I had pass quick on lo0 all in the pf.conf, the jail is running under lo1. I added pass ...
Draon con Color's user avatar
2 votes

Layer 3 routing based on HTTP packet content

The problem I see here is that you have to accept the TCP connection before you get to see the http request. So even if the system could use application level data it would not have that data at the ...
Peter Green's user avatar
  • 4,191
2 votes
Accepted

Layer 3 routing based on HTTP packet content

For BSD i would look into relayd(8) - its native to OpenBSD, but i believe FreeBSD has a port too. It is quite powerful and can do more than a few things (ex., proxy, load balancer, application ...
pete's user avatar
  • 723
2 votes

traffic shaping on OSX 10.10 with pfctl and dnctl

This is a script I used on El Capitan 10.11 with some success: #!/bin/bash # Reset dummynet to default config dnctl -f flush # Compose an addendum to the default config: creates a new anchor (cat /...
psmith's user avatar
  • 121
2 votes
Accepted

PF temporary reroute to different IP

The proper way to achieve this is to use table as a target for redirection. You can change content of table without reloading pf using pfctl. Just be aware that existing firewall states will keep ...
TuxPowered's user avatar
2 votes

Why add "keep state" to pf firewall rules

To complement Paul's answer - I looked this up from the OpenBSD pf documentation: The keep state option is the implicit default for all filter rules. Despite this, when specifying stateful options, ...
dakini's user avatar
  • 345
2 votes

Why add "keep state" to pf firewall rules

Without examples or asking the people who create the configurations, at least two reasons might be copying known working configurations without understanding the configurations or a partial ...
Paul's user avatar
  • 2,989
1 vote
Accepted

PF firewall how to increase `max states per rule`

Have you tried this? PF.CONF(5) File Formats Manual PF.CONF(5) … STATEFUL TRACKING OPTIONS A number of options related to stateful tracking can be ...
poige's user avatar
  • 9,371
1 vote

Putting all blocked ips into a table

I use this configuration on my servers, basically I have a table with trusted IPs and one table with ones that tries to bruteforce on SSH (few cases when it's open to the world). Create a new file in ...
Andrea Sessa's user avatar
1 vote
Accepted

SSH into a jail takes so long

Yeay! Good point, Andrew! The jail couldn't resolve anything since I forgot to nat jail traffic! nat pass on $ext_if from $jail_network -> ($ext_if) was missing in pf.conf :-s
Psyloh's user avatar
  • 11
1 vote

Why is there non-127.x.x.x traffic on my loopback device?

After much research, the correct fix for my issue, instead of modifying the line I mentioned, was to remove that line completely and to add a set skip on lo0 in the Options block of the pf.conf (after ...
papiro's user avatar
  • 159
1 vote

PF based gateway firewall for Openbsd 6.0

Your first scrub rule is redundant - you repeat the same effect with the next two rules. Make your specific block rules quick, or else they can be overwritten by later rules. (Default is the last ...
user398726's user avatar
1 vote

pf shortcuts for block quick

They are not. To be short, only two rules in the middle are valid, others are just a noise. from requires a pair of addresses and a to keyword, and the last rule is just a total nonense.
drookie's user avatar
  • 8,578
1 vote

pfSense can't access https website

Not getting far enough to be MTU-related. You're sending a SYN, getting a SYN ACK in reply, then RSTing the connection rather than completing the TCP handshake. Something is aborting the connection. ...
Chris Buechler's user avatar
1 vote
Accepted

Redirecting traffic to a specific address and port using PF on MacOS

The following PF rules work: nat on vmnet8 from bridge100:network to any -> (vmnet8) rdr pass on bridge100 inet proto tcp from any to any -> 172.16.122.128 port 8080 This forwards all ...
Sjoerd's user avatar
  • 196
1 vote

Redirecting traffic to a specific address and port using PF on MacOS

I guess, the problem is that you have not configured forwarding between 2 networks, (1) VM network (172.16.122.0/24) and (2) your LAN (192.168.2.0/24). To configure forwarding on your Mac, you ...
Andrey Sapegin's user avatar
1 vote

Can't access server on loopback address, only on private address

127.0.0.1 is your loopback. It is always local to the machine you are on. Creating a VM means it is a new machine and it has its own internal 127.0.0.1. You could create 50 VM's and they're each ...
chicks's user avatar
  • 3,773
1 vote

Redirection of pfctl on OSX gets error

My operating system is OSX 10.11 El captain. Where am I wrong? — In expectance that this syntax should work. Pf's version ported to MacOS from its first emerging till to Mojave (including) is kept ...
poige's user avatar
  • 9,371
1 vote

FreeBSD pf with NFS

NOTE: 192.168.1.9 is client and 14 is server and is work fine in my two server .... Client pf.conf : block all pass in on em0 inet proto { tcp udp } from 192.168.1.14 to em0 port { sunrpc nfsd-...
PersianGulf's user avatar
1 vote

How can one redirect to a new host all traffic destined for an old host?

If the services you are accessing are all accessed by name then I'd just create a host entry with in the hosts file on your dev machines. For example, if your machine was called myserver and resolved ...
hookenz's user avatar
  • 14.4k

Only top scored, non community-wiki answers of a minimum length are eligible