Date: Thu, 27 Nov 2008 20:26:55 +0800 From: "Kevin Foo" <chflags@gmail.com> To: freebsd-pf@freebsd.org, freebsd-net@freebsd.org Subject: if_bridge + pf rdr (bridged inline proxy) Message-ID: <25cb30811270426i6b5cc4c2s49030f64d06b0ec8@mail.gmail.com>
next in thread | raw e-mail | index | archive | help
Hi list,
I recently setup a bridge box with inline cache proxy. if_bridge with
pf filtering was working perfectly. However, squid-cache listening on
loopback device did not get any packets from pf rdr. I have seen
successful setups with OpenBSD's bridge spamd which rather a similar
setup. Is something broken on FreeBSD's if_bridge or am I missing some
configuration here?
pfctl -ss (on bridge box):
------------------
all tcp 127.0.0.1:3128 <- 71.14.235.147:80 <- 192.168.1.100:1041
CLOSED:SYN_SENT
all tcp 192.168.1.100:1041 -> 127.0.0.1:3128 SYN_SENT:CLOSED
Environment
------------------
FreeBSD bridge.mybox 7.1-PRERELEASE FreeBSD 7.1-PRERELEASE #0: Tue Nov
25 22:56:22 MYT 2008
kev@bridge.mybox:/usr/obj/usr/src/sys/BRIDGE i386
Squid Cache: Version 2.7.STABLE5 with --enable-pf-transparent
rc.conf:
------------------
cloned_interfaces="bridge0"
ifconfig_bridge0="addm bge0 addm bge1 up"
ifconfig_bge0="up"
ifconfig_bge1="up"
pf_enable="YES"
squid_enabld="YES"
pf.conf:
------------------
int_if="bge0"
ext_if="bge1"
rdr pass on $int_if inet proto tcp from any to any port 80 ->
127.0.0.1 port 3128
pass in all
pass out all
pass on $int_if route-to lo0 proto tcp from any to 127.0.0.1 port 3128
sysctl net.link.bridge :
------------------
net.link.bridge.ipfw: 0
net.link.bridge.log_stp: 0
net.link.bridge.pfil_local_phys: 1
net.link.bridge.pfil_member: 1
net.link.bridge.pfil_bridge: 0
net.link.bridge.ipfw_arp: 0
net.link.bridge.pfil_onlyip: 0
Hping Testing (from client 192.168.1.100):
------------------
hping -S -p 80 -c 10 www.google.com
A quick search on freebsd-pf archive, I found a thread on similar setup in 2004.
http://lists.freebsd.org/pipermail/freebsd-pf/2004-October/000522.html
However, the bridge code of FreeBSD was blamed for poor performance
and lack of functionalities. A more recent post on freebsd-net
mailing list on similar issue.
http://lists.freebsd.org/pipermail/freebsd-net/2008-September/019556.html
Any ideas? TIA.
P/S : please cc me as I'm not subscribed to freebsd-pf nor freebsd-net
mailing list. Thanks.
--
Regards
Kevin Foo
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?25cb30811270426i6b5cc4c2s49030f64d06b0ec8>