From owner-freebsd-pf@FreeBSD.ORG Mon Dec 4 11:46:49 2006 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 24F5516A50B for ; Mon, 4 Dec 2006 11:46:49 +0000 (UTC) (envelope-from niklassaers@gmail.com) Received: from nf-out-0910.google.com (nf-out-0910.google.com [64.233.182.184]) by mx1.FreeBSD.org (Postfix) with ESMTP id DFD2343F23 for ; Mon, 4 Dec 2006 11:42:29 +0000 (GMT) (envelope-from niklassaers@gmail.com) Received: by nf-out-0910.google.com with SMTP id x37so4149505nfc for ; Mon, 04 Dec 2006 03:42:52 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=Tq8WW4PVLjWezqTG4Q4fjBS6ee2fQ/cfckR7QGa2561nCPYS8GxkuvS+AkfL2ygd0Zb1GsMud7FHGvuVYi18Q1feRadjQnSBzP9YPoJaVU3BUCH4YWa9AkWtYU/L5HVNxpKuM8jdKdCtmnd8eYGYgNwl/GX/MrfyegfSc0WduU0= Received: by 10.82.190.2 with SMTP id n2mr1454365buf.1165232170070; Mon, 04 Dec 2006 03:36:10 -0800 (PST) Received: by 10.82.139.4 with HTTP; Mon, 4 Dec 2006 03:36:09 -0800 (PST) Message-ID: <491ac4fb0612040336t2a7d2d40xaee0be24166ad593@mail.gmail.com> Date: Mon, 4 Dec 2006 12:36:09 +0100 From: "Niklas Saers" To: "Daniel Bye" , freebsd-pf@freebsd.org In-Reply-To: <20061204062158.GA57910@catflap.slightlystrange.org> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <491ac4fb0612030325x2bbbb88br65ad4c3a2f4c8f43@mail.gmail.com> <20061204062158.GA57910@catflap.slightlystrange.org> Cc: Subject: Re: newbie to pf X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Dec 2006 11:46:49 -0000 Hi guys, On 12/4/06, Daniel Bye wrote: > From reading the excellent documentation at the OpenBSD site, I think > you are missing a `pass' rule for your redirected traffic. Yes, I was. I've substituted "rdr" for "rdr pass" that I believe should work great for ssh, https and mysql. > Remember that the filtering engine will > see the redirected packets /after/ translation occurs, so take that > into account if you write dedicated rules. Thanks for the heads-up there, at the time I wrote this I didn't think of that. Been doing much reading since then, and as you point out, that's an excelent documentation. > As for your ssh problem - this may be related to a DNS timeout. It was indeed. :-) The main problem turned out to be the ADSL router, not pf. The forwarded data was not being forwarded correctly, but a flash update and reconfig later the data are coming in fine and being forwarded just fine. What I'm wondering about now is: what weaknesses are there in my setup? Is there anything I should be particularly aware of? # macros ext_if = "sis0" int_if = "sis1" bus_if = "sis2" internal_net = "10.0.2.0/24" business_net = "10.0.3.0/24" soekris = "{ 10.0.0.4, 10.0.2.1, 10.0.3.1 }" # tables table const { self } # options set block-policy drop set state-policy if-bound #set require-order yes #set fingerprints "/etc/pf.os" #set loginterface $ext_if # scrub incoming packets set skip on lo scrub all reassemble tcp fragment reassemble # redirection rdr pass on $ext_if proto tcp from any to any port 22 -> 10.0.3.2 rdr pass on $ext_if proto tcp from any to any port 443 -> 10.0.3.2 rdr pass on $ext_if proto tcp from any to any port 3306 -> 10.0.3.2 # nat nat on $ext_if from $internal_net to any -> ($ext_if) nat on $ext_if from $business_net to any -> ($ext_if) no nat on $ext_if from $internal_net to $business_net no nat on $ext_if from $internal_net to $soekris # setup a default deny policy block drop log all # pass traffic on the loopback interface in either direction pass quick on lo0 all pass quick on $int_if all pass quick on $bus_if all # outgoing dns, ntp pass out quick on $ext_if inet proto udp from ($ext_if) to any port { 53, 123 } keep state # outgoing from firewall pass out log quick on $ext_if inet proto tcp from ($ext_if) to any flags S/SA keep state pass out log quick on $ext_if inet proto { udp, icmp } from ($ext_if) to any keep state # incoming active ftp-data (this is required for active ftp to work) pass in log quick on $ext_if inet proto tcp from any port 20 to ($ext_if) port >= 1024 flags S/SA keep state # incoming tcp and udp from the internal network to the internet pass in log quick on $int_if inet proto tcp from $internal_net to ! flags S/SA modulate state pass in log quick on $int_if inet proto udp from $internal_net to ! keep state pass in log quick on $bus_if inet proto tcp from $business_net to ! flags S/SA modulate state pass in log quick on $bus_if inet proto udp from $business_net to ! keep state Cheers Nik