Date: Fri, 8 Sep 2006 18:59:59 +0200 From: Max Laier <max@love2party.net> To: freebsd-pf@freebsd.org Subject: Re: TRansparent firewalll (pf vs ipfw) Message-ID: <200609081900.04884.max@love2party.net> In-Reply-To: <f51cdb70609080756t7de2b168xd632240cdc5da9ae@mail.gmail.com> References: <f51cdb70609080756t7de2b168xd632240cdc5da9ae@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--nextPart6782219.Lfiik0g3gK
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
On Friday 08 September 2006 16:56, Mircea Popescu wrote:
> I have an Freebsd 6.0 box with a functioning bridge (bridge0 =3D fxp0 +
> rl0)
>
> My problem is that if I try to cut access to any port on bridge0
> interface using PF, nothing happens.
>
> For example I've tried to cut access to ssh service from a certain ip
> ... putty still managed to get through.
>
> The rule was:
> block on bridge0 proto { tcp udp } from yy.yy.yy.yy to xx.xx.xx.xx port
> pppppp
>
> BUT, with the following rule:
> block on rl0 proto { tcp udp } from yy.yy.yy.yy to xx.xx.xx.xx. port
> pppppp
>
> Putty couldn't obtain a connection.
I suggest that you read the if_bridge(4) manual page, which talks=20
extensively about packet filtering options.
> Considering the fact that in linux, which I gave up using, making a
> bridge would disable the interfaces within, I WOULD LIKE TO HAVE SOME
> QUESTIONS ANSWERED:
>
> 1. Once the bridge0 interface is created, the fxp0 and rl0 interfaces
> could still get their own ip addresses? (in linux this would be
> imposible)
You can either assign an IP to the interface or to the bridge itself,=20
iirc.
> 2. Which firewall it is more desirable to use with a bridge? PF or
> IPFW)
The one you understand best and like the most.
=2D-=20
/"\ Best regards, | mlaier@freebsd.org
\ / Max Laier | ICQ #67774661
X http://pf4freebsd.love2party.net/ | mlaier@EFnet
/ \ ASCII Ribbon Campaign | Against HTML Mail and News
--nextPart6782219.Lfiik0g3gK
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (FreeBSD)
iD8DBQBFAaGUXyyEoT62BG0RAvbLAJ4lgSgeyDqS7/S6Mk5sPcokpcUvUgCZAS00
tq7UyZkc3mlTAeyUlX8AuKE=
=wbFC
-----END PGP SIGNATURE-----
--nextPart6782219.Lfiik0g3gK--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200609081900.04884.max>