Date: Tue, 15 Jul 2014 21:15:50 +1000 From: Peter Jeremy <peter@rulingia.com> To: freebsd-pf@freebsd.org Subject: Filtering bridge(4) traffic Message-ID: <20140715111550.GC32968@server.rulingia.com>
next in thread | raw e-mail | index | archive | help
--xHFwDpU9dbj6ez1V Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable I'm successfully using pf(4) on FreeBSD 9.2 as a firewall and would like to also use the box as an AP. At this stage I'm only using IPv4. As originally configured, I have re0 connected to the Internet, em0 connected to my internal LAN and a couple of jails attached to loopback interfaces. All the interfaces are interconnected using nat/rdr and filter rules. I'm trying to add an AP (run0/wlan0), bridged with em0, to replace an existing standalone AP. At this point, I don't need to filter packets between wlan0 and em0. I've successfully migrated my rules from em0 to bridge0 and can correctly block/pass traffic between the firewall (and Internet) and internal devices via either em0 or wlan0. New connections between em0 and wlan0 also work but existing connections (eg clients failing over between wired and wireless) fail - apparently due to missing state table entries. I don't understand why packets between wlan0 and em0 are being filtered and would appreciate any insights. Relevant sysctl parameters (all default): net.link.bridge.pfil_local_phys: 0 net.link.bridge.pfil_member: 1 net.link.bridge.pfil_bridge: 1 net.link.bridge.pfil_onlyip: 1 Extract from pf.conf: set skip on lo0 scrub in all nat/rdr rules... block out log all block in log all block in quick proto udp from any to any port { netbios-ns, netbios-dgm, wh= o, ldap, 1900, 3902, mdns, 9956 } pass in quick on em0 tag em0 pass in quick on wlan0 tag wlan0 pass out on wlan0 all tagged em0 pass out on em0 all tagged wlan0 pass out on bridge0 all tagged em0 pass out on bridge0 all tagged wlan0 other filtering rules... --=20 Peter Jeremy --xHFwDpU9dbj6ez1V Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQJ8BAEBCgBmBQJTxQ1mXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRFRUIyOTg2QzMwNjcxRTc0RTY1QzIyN0Ux NkE1OTdBMEU0QTIwQjM0AAoJEBall6Dkogs0OooP/AwJsMfs10prBt6a4cOw+KEU NDtP+c55BjlRLGI1+aBVrZ8Wq5cxJa5MpMHqNc9D1AvHyDYCeAKGzpAJ92mWEZTH sUo6lDfcQ3kTCZzuqop3VLPV92Z07BCETfQLWxz6Lc9Wx0tdd2m8MeRZoTVtu1Uc 1hLIJ5Sz97Ua4I08sPAYiHeg9hW4ctGBMEKNDUgpLY36BpNP6s/vJNAQh5UCwSjZ VShjRVk69yZWLceFoLLPEU36YfDzae5VTe7xKQiY4mahqHhG1uNU5gvpqd2FGHVb SvCjTAuhX0coMddFp/wW4jnh30YwdZ1NAnUXfHXBqcRFRQIiDPz3CvRwhdo0GGRE b1SK1PnaGHRq+t1burCic16gnSbj5gkktL2p3+oQqIYD1DE/1kNDnzfztNTJpOqa DVWiYjAR1qsUFaA9YfXYq26usoms2skZFNzlXEm8ImdOGLC49v7ulhPxZY3XIBKd 1NmIlCqjQzWJlXN2X53AsE4O/ovbMV3zgfqhiPhdT1REjoLXKdRUwkR+QsS4PFJw xbjtprO7nSkiYUifeZILbOpWPWv6xyGO21b39nQluzN79CKvEZsZ1UbkFrv1zX4a QpP+hFeEcKyzhMGdl/54lfIuP16owF5sBks+XgJlghhzjhOq3n4ohqPMTadoqS1Z 0T2xoL0eyGLNoYiEeGfw =G4Kh -----END PGP SIGNATURE----- --xHFwDpU9dbj6ez1V--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20140715111550.GC32968>