From owner-freebsd-questions@FreeBSD.ORG Sun Mar 9 19:20:45 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 6B999106566C for ; Sun, 9 Mar 2008 19:20:45 +0000 (UTC) (envelope-from norgaard@locolomo.org) Received: from mail.locolomo.org (97.pool85-48-194.static.orange.es [85.48.194.97]) by mx1.freebsd.org (Postfix) with ESMTP id 0DD8B8FC1C for ; Sun, 9 Mar 2008 19:20:45 +0000 (UTC) (envelope-from norgaard@locolomo.org) Received: from sleipner.local (unknown [192.168.0.62]) by mail.locolomo.org (Postfix) with ESMTP id DD3921C0847; Sun, 9 Mar 2008 20:20:42 +0100 (CET) Message-ID: <47D4388A.2090604@locolomo.org> Date: Sun, 09 Mar 2008 20:20:42 +0100 From: Erik Norgaard User-Agent: Thunderbird 2.0.0.12 (Macintosh/20080213) MIME-Version: 1.0 To: erik Wilson References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit Cc: freebsd-questions@freebsd.org Subject: Re: Help with pf ruleset X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Mar 2008 19:20:45 -0000 erik Wilson wrote: > I'm pulling my hair out here. I've been working on this for days without > any success. > > I've whittled the ruleset down to the barest possible rules and even that > doesn't work. I'm at my wits end. I would really appreciate it if someone > could show me where i'm being a complete and total moron. > > Here's the situation. I have a somewhat unique environment. It consists of > 2 WAN's, an internal LAN, and numerous VLANS (isolated clients, which need > to be accessible from the internet, but not to each other). This runs in a > VMWare esx server, but that's not really important. > > FreeBSD 7.0-RELEASE > > em0 = lan (10.0.0.x) > em2 = WAN1 (y.y.y.y) (dhcp) > em3 = WAN2 (x.x.x.x) (static /28 subnet) > > the default gateway is on nic2. nic3 will need to forward ip:port's to > various vlans. nic2 is used for all outbound lan traffic (internet). nic2 > will need to failover to nic3 eventually, and nic3 will have to failover to > nic2 (for outbound, obviously no choice for inbound). > > So here's the problem. I can't even get nic2 or nic3 to respond to a ping > request from outside my network when pf is enabled. I know the interfaces > are set up correct, as I can ping the default gateways of both interfaces. > > Also, outbound NAT works perfectly on wan1. > > Here's my ruleset. > > lan_if="em0" > wan1_if="em2" > wan2_if="em3" > set block-policy return > set skip on lo0 > nat on $wan1_if from $lan_if:network to any -> ($wan1_if) > block in log > pass out log keep state > pass in log inet proto icmp all icmp-type echoreq keep state > pass in log quick on $lan_if > > Looks simple enough, right? Why won't it work? All i want is to get a ping > from both of the firewalls WAN's from outside the network. > > Any ideas? How about the log? I know you have cut away a lot of rules, but maybe that just makes things more confusing. Try to nest your rules in the following order: direction - interface - protocol - src net - dst net - port/type You should need no "out" rules if you have "in" rules with keep state. At each branch level make a catchup rule at the end with default action and "quick" key word to make sure packets don't spill over and get matched by other rules. Hopefully this will help you pin down where things go wrong. Cheers, Erik -- Erik Nørgaard Ph: +34.666334818 http://www.locolomo.org