Hot answers tagged

6 votes
Accepted

All IPv6 traffic blocked by pf

By enabling logging I managed to work out that this is because the ICMP6 router solicitation was being blocked. Adding pass proto ipv6-icmp from any to any to the end of the file fixed the problem.
user avatar
  • 181
5 votes
Accepted

PF: Block all, but one subnet firewall rule?

its because its specifying a single ip, you need to write it with the subnet: pass in from 111.111.0.0/16 man pf.conf should list a few methods of defining ranges and blocks. A side note, take care ...
user avatar
  • 693
5 votes
Accepted

PF vs -m of iptables

AFAIK, pf does not have the flexibility and modules available in iptables. iptables comes with really large number of modules that provide more match options and others that provide more targets. You ...
user avatar
  • 35.3k
4 votes
Accepted

pf (Mac OS X) rule to redirect all traffic to a specific ip/port

So, I am likely misunderstanding but I think you may be confusing the iptables TPROXY and REDIRECT targets - but I don't think that's important. Ignoring that, you may still be able to realize your ...
user avatar
  • 1,747
3 votes

Changing PF rules on the fly to mitigate damage of DDoS (OpenBSD 6.4)

Since no one has answered my question this is the pf configuration I ended up with. Specifically look at the line for setting cookies after the table is filled with 15% open tcp connections. SYN ...
user avatar
  • 171
3 votes
Accepted

PF firewall on FreeBSD for allowing SSH and OpenVPN Traffic

Setting up pf may be a bit of a hassle. You need to understand that pf treats all interfaces absolutely equally and there is no concept of packets originating on the box itself as there is in iptables ...
user avatar
3 votes

pf firewall server configuration

The message is normal because ALTQ is not compiled into the stock FreeBSD kernel. Unless you need to use ALTQ it doesn't matter. The start up of the firewall interrupts all current connections, ...
user avatar
3 votes

How to block MAC address in pf firewall

To do that you have to tag the ethernet frame. (http://www.openbsd.org/faq/pf/tagging.html) Tagging can be performed at the Ethernet level if the machine doing the tagging/filtering is also acting as ...
user avatar
  • 128
3 votes

How to block MAC address in pf firewall

No, there isn't. You know that it's trivial for people to change their MAC addresses, correct? Additionally, the instant a packet passes through a later 3 routing device, the Mac address information ...
user avatar
  • 108k
3 votes
Accepted

Almost empty pf.conf still logs packets

I have no idea why am I receiving them It's multicast traffic. where can I read about those default match rules Well, the thing in whole is partially documented but it's not that obviously ...
user avatar
  • 9,113
2 votes
Accepted

OpenBSD cannot set frag limit more than 6144

From the OpenBSD 5.3 upgrade guide: pfctl(8) will abort and fail to load the rule set if the 'frags' limit in pf.conf is higher than the kern.maxclusters sysctl This is to guard against allowing a ...
user avatar
  • 7,588
2 votes

Forwarding IP address using pf

sysctl net.inet.ip.forwarding=1 This will just enable routing on your machine. It could work if you would create a to allow any to the destination IP on the external interface (at least in theory) (...
user avatar
  • 485
2 votes

traffic shaping on OSX 10.10 with pfctl and dnctl

This is a script I used on El Capitan 10.11 with some success: #!/bin/bash # Reset dummynet to default config dnctl -f flush # Compose an addendum to the default config: creates a new anchor (cat /...
user avatar
  • 121
2 votes
Accepted

DNS lookup to localhost gives network error

After some more testing the pf rules, I briefly let all traffic pass and realized the mistake was that while I had pass quick on lo0 all in the pf.conf, the jail is running under lo1. I added pass ...
user avatar
2 votes

Layer 3 routing based on HTTP packet content

The problem I see here is that you have to accept the TCP connection before you get to see the http request. So even if the system could use application level data it would not have that data at the ...
user avatar
  • 4,018
2 votes
Accepted

Layer 3 routing based on HTTP packet content

For BSD i would look into relayd(8) - its native to OpenBSD, but i believe FreeBSD has a port too. It is quite powerful and can do more than a few things (ex., proxy, load balancer, application ...
user avatar
  • 693
2 votes
Accepted

PF temporary reroute to different IP

The proper way to achieve this is to use table as a target for redirection. You can change content of table without reloading pf using pfctl. Just be aware that existing firewall states will keep ...
user avatar
1 vote

pf shortcuts for block quick

They are not. To be short, only two rules in the middle are valid, others are just a noise. from requires a pair of addresses and a to keyword, and the last rule is just a total nonense.
user avatar
  • 7,954
1 vote

Putting all blocked ips into a table

I use this configuration on my servers, basically I have a table with trusted IPs and one table with ones that tries to bruteforce on SSH (few cases when it's open to the world). Create a new file in ...
user avatar
1 vote
Accepted

SSH into a jail takes so long

Yeay! Good point, Andrew! The jail couldn't resolve anything since I forgot to nat jail traffic! nat pass on $ext_if from $jail_network -> ($ext_if) was missing in pf.conf :-s
user avatar
  • 11
1 vote

Why is there non-127.x.x.x traffic on my loopback device?

After much research, the correct fix for my issue, instead of modifying the line I mentioned, was to remove that line completely and to add a set skip on lo0 in the Options block of the pf.conf (after ...
user avatar
  • 159
1 vote

PF based gateway firewall for Openbsd 6.0

Your first scrub rule is redundant - you repeat the same effect with the next two rules. Make your specific block rules quick, or else they can be overwritten by later rules. (Default is the last ...
user avatar
1 vote
Accepted

Redirecting traffic to a specific address and port using PF on MacOS

The following PF rules work: nat on vmnet8 from bridge100:network to any -> (vmnet8) rdr pass on bridge100 inet proto tcp from any to any -> 172.16.122.128 port 8080 This forwards all ...
user avatar
  • 196
1 vote

Redirecting traffic to a specific address and port using PF on MacOS

I guess, the problem is that you have not configured forwarding between 2 networks, (1) VM network (172.16.122.0/24) and (2) your LAN (192.168.2.0/24). To configure forwarding on your Mac, you ...
user avatar
1 vote

Can't access server on loopback address, only on private address

127.0.0.1 is your loopback. It is always local to the machine you are on. Creating a VM means it is a new machine and it has its own internal 127.0.0.1. You could create 50 VM's and they're each ...
user avatar
  • 3,599
1 vote

Redirection of pfctl on OSX gets error

My operating system is OSX 10.11 El captain. Where am I wrong? — In expectance that this syntax should work. Pf's version ported to MacOS from its first emerging till to Mojave (including) is kept ...
user avatar
  • 9,113
1 vote

pfSense can't access https website

Not getting far enough to be MTU-related. You're sending a SYN, getting a SYN ACK in reply, then RSTing the connection rather than completing the TCP handshake. Something is aborting the connection. ...
user avatar
1 vote

FreeBSD pf with NFS

NOTE: 192.168.1.9 is client and 14 is server and is work fine in my two server .... Client pf.conf : block all pass in on em0 inet proto { tcp udp } from 192.168.1.14 to em0 port { sunrpc nfsd-...
user avatar
1 vote

pf - redirect rule does not work

Have you checked your sshd listening addresses? $ netstat -a | grep ssh tcp4 0 0 *.ssh *.* LISTEN tcp6 0 0 *.ssh *.* ...
user avatar
1 vote

Enabling pf for transparent proxy on Mac OS X Mountain Lion

Did you try net.inet.ip.scopedroute=0? From http://lucumr.pocoo.org/2013/1/6/osx-wifi-proxy/: Now currently if you finish that above setup you will notice that nothing actually works. The cause ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible