Skip site navigation (1)Skip section navigation (2) 
Date:      Tue, 14 Jul 2009 13:24:30 +0200
From:      Aleksic Predrag <apetar@gmail.com>
To:        Peter Maxwell <peter@allicient.co.uk>, freebsd-pf@freebsd.org
Subject:   Re: pf between two lans
Message-ID:  <20090714132430.75bb46c8@overlord>
In-Reply-To: <7731938b0907131722v460e5429ve4906ff822b2719@mail.gmail.com>
References:  <3228ef7c0907111044i55b965d3me10ad146314517bf@mail.gmail.com> <20090712155707.4925813c@overlord> <17838240D9A5544AAA5FF95F8D520316065A8437@ad-exh01.adhost.lan> <7731938b0907131722v460e5429ve4906ff822b2719@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help 

[-- Attachment #1 --]
On Tue, 14 Jul 2009 01:22:06 +0100
Peter Maxwell <peter@allicient.co.uk> wrote:

 > Can you post the output of: pfctl -s r

# pfctl -sr
scrub in all random-id fragment reassemble
block drop log (all) all
block drop in on sk0 inet proto icmp all icmp-type echoreq
block drop out log (all) quick on sk0 from any to <perm-ban>
block drop in log (all) quick on sk0 from <ssh-bruteforce> to any
pass in on sk0 inet proto tcp from any to 192.168.2.248 port = 57277 flags S/SA keep state
pass in on sk0 inet proto udp from any to 192.168.2.248 port = 57277 keep state
pass out on sk0 inet proto udp from 192.168.2.248 port = 57277 to any keep state
pass out on sk0 inet proto tcp from 192.168.2.248 port = 57277 to any flags S/SA keep state
pass in on sk0 inet proto udp from any to any port = http keep state
pass in on sk0 inet proto tcp from any to any port = http flags S/SA keep state
pass in on sk0 proto udp from any to any port = 2706 keep state
pass in on sk0 proto tcp from any to any port = 2706 flags S/SA keep state
pass quick proto tcp from any to any port = ssh flags S/SA keep state (source-track rule, max-src-conn 10, max-src-conn-rate 1/3, overload <ssh-bruteforce> flush global, src.track 3)
pass quick proto udp from any to any port = ssh keep state (source-track rule, max-src-conn 10, max-src-conn-rate 1/3, overload <ssh-bruteforce> flush global, src.track 3)
pass out on sk0 proto tcp all flags S/SA modulate state
pass out on sk0 proto udp all keep state
pass out on sk0 proto icmp all keep state
pass out on sk0 proto esp all keep state

pass in on vr0 inet from 192.168.2.0/24 to any flags S/SA keep state
pass out on vr0 inet from any to 192.168.2.0/24 flags S/SA keep state
pass in on vr1 inet from 192.168.0.0/24 to any flags S/SA keep state
pass out on vr1 inet from any to 192.168.0.0/24 flags S/SA keep state

Should i replace netmask to /16 in last four rules?

> What happens if you try things without pf loaded
> and with pf loaded but a pass all ruleset?

With pf loaded i can open almost anything but not ssh connection. 
I can ping, browse shares and printers between lans.

Without pf loaded i can do all that and ssh.

Yesterday i changed default ssh port on remote box and it let me in 
with the same pf rules loaded. 

Now, I'm also suspicious about remote box, it is CentOS box with untouched 
config files, maybe SELinux is preventing ssh login.

> Have you got gateway_enable set in your rc.conf (I think it shows as
> net.inet.ip.forwarding being set to 1 in your sysctl)?
 
sysctl -a | grep net.inet.ip.forwarding
net.inet.ip.forwarding: 1

> Can you post the results of the same tcpdump with a larger window size
> ( -s 1024 ) and/or a tcpdump on the network interface itself?

see attachment  
> 
> 
> 
> 
> 
> 
> 2009/7/13 Michael K. Smith - Adhost <mksmith@adhost.com>:
> > Hello Aleksic:
> >>
> >> no nat on $extIF inet proto {tcp, udp} from $intIF:network to
> >> $intIF2:network
> >> no nat on $extIF inet proto {tcp, udp} from $intIF2:network to
> >> $intIF:network
> >>
> > If nothing else, these rules won't match because the traffic isn't
> > traversing the External Interface.
> >
> > no nat on $intIF2 inet proto {tcp, udp} from $intIF:network to
> > $intIF2:network
> > no nat on $intIF inet proto {tcp, udp} from $infIF2:network to
> > $intIF:network
> >
> > Regards,
> >
> > Mike
> > _______________________________________________
> > freebsd-pf@freebsd.org mailing list
> > http://lists.freebsd.org/mailman/listinfo/freebsd-pf
> > To unsubscribe, send any mail to
> > "freebsd-pf-unsubscribe@freebsd.org"
> >


[-- Attachment #2 --]
òbf\J]jL;E@@pCȨo}RV(g`-c쌾%Γp%ug%V/w#!t/:p.b5 8}
TS%_6ύUoa酔ekdVBm{fbf\JNN]jL;E@@@D,-oeh]|+{VS?}jh>bf\J%JJ]jL;E<@@f_	(gӠR@fr
EB"
>`ap=8Fbf\J?XX;]jLEJr`uCo6>3
r30Im0ĭAamzS>#j}xbf\JJJ;]jLE<^@?Wy"ѼЛC
Qubf\JCJJ]jL;E<@@}ys9"Ѽv
AQubf\J3^	;]jLEʂrH_	zWߌu>7'd3>PgIU!g=hPiPuX紊9b
g>"qi{w[6$gƚ]6쭃{q0x·Il?
@u%\$,xwؘ)Y
NFcRW\fyMhqWd#A<+G?RN2,x]3!qv{&.$vI˥tR9vlNFzp{qUfp^]G,}]ZdGӲeʚֲnT}ŋ2ʼj9dxVizdA?DCxwB	RlRʂbd^p`FXqY>0Y$u:{a3H10Ɲ~6Gz?pTAgy_Xo+u\Sچ)z?bf\Jn	]jL;E@@yЀءex$#P%TOD"t?	3Cj!y%d:oy2F!#Vݹ~:'Eϭŏ˦r?婪W޿Ǵbf\Ja
>>;]jLE0/t Ѐe7
bf\J<<;]jLE.(gDVE䨛Ui֜Pqxbf\J:]jL;E@@	W
~Aj>;Tv<ڔD%Bqħ@f>:nD?O{)XzozxzQDUS5&PH&`Ů	[ph׫bf\J>>;]jLE0бnB	W
ը.S[+ML$
4<ef\J
JJ]jL;E<@@}ys9"Ѽj
AQuff\JO;E@@ww{9016 3 ipp://192.168.0.246:631/printers/HP_LaserJet_P1006 "" "Added by HAL" "HP LaserJet P1006 Foomatic/foo2xqx (recommended)" job-sheets=none,none lease-duration=300
gf\J <<]jL;;gf\J0<<;]jL]jL;kf\JV
JJ]jL;E<@@}ys9"ѼS%
AvQuvf\J[FF]jL;E8#@@]>WitO
B),fwf\J1NN]jL;E@@@p[J5snC
BjID-^M=X[9E,h;Kh|v8?t^PfiOd_`9Nlb׍6GS'h"K79{ t-a||$YJ%4EKwIy)[VI>
}_\.aƺi,-F"޿q6&hVB俤bd6e_oδ* KՇDl9*oMT=f) kW/~Dל*O2vF-wf\J?
FF;]jLE8@s[J5ns'<4)q
gBۖwf\J
BB]jL;E4@@q[J5s'n
B\gwf\J

JJ]jL;E<@@}ys9"Ѽ#|
BQuxf\J;E@@ww29016 3 ipp://192.168.0.246:631/printers/P1006 "CentOS" "HP Laserjet P1006" "HP LaserJet P1006 Foomatic/foo2xqx (recommended)" job-sheets=none,none lease-duration=300
f\JÖFF]jL;E8@@߆8K͖d$,
BE0ĭf\J]jL;EY@@Z_!w$ch
BON!DbrP1)䯋U'0@dQ n+pxޟD2	2XG
[z*7l%H,D)ȍʸ$z^\
RlSZ:+
C-/CPdLa4qAp
]ū׶㪔q`NQ\􏀗:)&1'?PPʥNmVE.=UJK:(z8
,&R{헪A{/4VyV_dҩ:Uo(q,l`刪-PZFIy?[3jӠ7C\$!(ptȼwyV^ew..8׫f\Jo;E@@ww{9016 3 ipp://192.168.0.246:631/printers/HP_LaserJet_P1006 "" "Added by HAL" "HP LaserJet P1006 Foomatic/foo2xqx (recommended)" job-sheets=none,none lease-duration=300
f\JR$FF]jL;E8@@8@0ǀ,
BbCf\J;FF]jL;E8@@⊝<IG
BbCf\J]jL;E@@f^AiqdA.췱%4	ֆqlpf P#JͲGoS;Ӂ
èW7?״0[#(Dn2Tbhg\p=f\JBLL]jL;E>@@Ȍ9ؠ*;gK~J E+Wuwum$KWf\JNN]jL;E@@@VGȶ,*W33u8ovq7?/Uf\J<<;]jLE.un9Ȍ9ƨ4{=Cɰ
08΁f\J)]jL;E@@
μa}|_րهkχd^CnŐ?լM<1<HHYFsTݦf$Jb
& ʣj0I
tNU3?K+wUif\JTx<<;]jLE.lRTGȶ
gȽIBNfߋf\Jl~]jL;E@@;E幙c*wqA],srR~k-/wKl,,7h$bY]ö~d
kχȒA6)G
'!:C4O*JDN$bf\J=OO;]jLEA6oAT^Ai-TVY&[^d!n(rf\Jr ]jL;E@@
μa}|EAWjր[DYTdUl
z},aߌͺdt]yt܃,)y(¿) jm-hyAڝg-0Odd?MzB"}s@xf\Jƪ]jL;E@@;E幙c*w0X-SqA%a^$zt2w17dB&.2
-!Th{1L'^!0#(<S'H? QA~Nk)(<f\JJJ]jL;E<@@}ys9"ѼŻ
ByQuf\J]jL;E@@
μa}88ր9GJ$-+t0Ol5ޔzX"[*lLfGT̡7m
|H_``3cҶQ ͙=`Kf\J$]jL;E@@;E幙c*wB[9qAyV58{'8QeA!slDb_AS
w~Pw7'7wjFLE-p-6wcbf\J#<<]jL;;f\J5<<;]jL]jL;f\J;E@@ww29016 3 ipp://192.168.0.246:631/printers/P1006 "CentOS" "HP Laserjet P1006" "HP LaserJet P1006 Foomatic/foo2xqx (recommended)" job-sheets=none,none lease-duration=300

[-- Attachment #3 --]
òud\Jtt=sk0W2E4Z
@?-J}+ekPjwU&;}d
UQd\Jv
tt=sk0W2E42@?CJ}+egPjwU&;}
V:Qd\J(tt=sk0W2E4^@?|J}+ePjwU&;}
VQd\Jtt=sk0W2E45@?J}+eMPjwU&;}F
X,Qd\J	tt=sk0W2E4m@?jJ}+erPjwU&;}
ZQd\J=sk0W2E[!@?BDêIjsXҌ?>Pi:6u9p"U\[a&4# P{z ij\wTYZ|Qd\J˜=sk0W2Et@lDês߽?>XҿPѰ )L .b~F0ids)ͩRiCkBϸ<uA@et?WX
+n{~d웏6;nQ-ㆺ[ܣ3 lWGְT1EOMӟf26Wyl,1pޘ!YD5*?nWJB}22x#{`a7:礄x)L\SʝQ:\*O>Jjzp;3o*Jm
^!<~ddEo1OʻZiݺVp)<-jw9Z"6!ctf%T,i;;l _$}phmҕ[,a)TZV#h;ivf[`q#]vOSb+k륲@'Cj:_#Qypndhͫ~ym5Js62H@9T%.ڦK[ tD:
4fR޹߲t7u]
biY ؊Ln}4*A:	ƱT:V[rO?2z0mojM__ˀ	^t3uJ\ΙOX.n\}=8.u~
,/حNPd
j`n[&VAvj䛘\\7ɰq9{3ghã
QMRY4#\.h7STG39qGddn+B\L GhU 
!F)xwɱ/nJc]&`(5ns*TOf]&Cv]O`6Z?%b':\辢ֆcZ^4%rV}>~/oEփy/.$nom6r7,Dԉ?2)^߷D>5Pm5JT̷kukw]|s-A"w>R}oPÜWK:{•bΗtM#ƥH!M'm#l=c^7-.M>MT1gixk޳]"d{cp"?4eIoN«rCt
o$6jF޴􀾋,haT靪N\ئ_aB]X?gӸ7	5xwON<LH&
ZޭN'e'>9ڰݏN
K[+dObR~9	z,aՙܚc{t[+/ӈ5=dIDVۨ@vNBܰgpu䘦(Źk~*8BԲEG"Q]vĞA[	+T=nȹd\JJ*yy=sk0W2E9W^@?"%[yx|tP9}KJ8:d\JLtt=sk0W2E4K@?J}+eZPjwU&;}
_Qd\J6Sxx=vr1W2E8@@t8@0ǀ,8
;RzCd\Jjxx=vr1W2E8f@@⊝<IX 
;RCd\J=sk0W2Ex8?@?T0i96ڕ*g!Eg&gR}gWgm
M;@
M;@
M;@@ؼd\J:8=sk0W2E[a+@?)9DêFsXҌ?>P:6u9p"U\[a&4# P{z ij\wTYZ|Qd\J=sk0W2E+@lDês߽?>XҿPѰ )L .b~F0ids)ͩRiCkBϸ<uA@et?WX
+n{~d웏6;nQ-ㆺ[ܣ3 lWGְT1EOMӟf26Wyl,1pޘ!YD5*?nWJB}22x#{`a7:礄x)L\SʝQ:\*O>Jjzp;3o*Jm
^!<~ddEo1OʻZiݺVp)<-jw9Z"6!ctf%T,i;;l _$}phmҕ[,a)TZV#h;ivf[`q#]vOSb+k륲@'Cj:_#Qypndhͫ~ym5Js62H@9T%.ڦK[ tD:
4fR޹߲t7u]
biY ؊Ln}4*A:	ƱT:V[rO?2z0mojM__ˀ	^t3uJ\ΙOX.n\}=8.u~
,/حNPd
j`n[&VAvj䛘\\7ɰq9{3ghã
QMRY4#\.h7STG39qGddn+B\L GhU 
!F)xwɱ/nJc]&`(5ns*TOf]&Cv]O`6Z?%b':\辢ֆcZ^4%rV}>~/oEփy/.$nom6r7,Dԉ?2)^߷D>5Pm5JT̷kukw]|s-A"w>R}oPÜWK:{•bΗtM#ƥH!M'm#l=c^7-.M>MT1gixk޳]"d{cp"?4eIoN«rCt
o$6jF޴􀾋,haT靪N\ئ_aB]X?gӸ7	5xwON<LH&
ZޭN'e'>9ڰݏN
K[+dObR~9	z,aՙܚc{t[+/ӈ5=dIDVۨ@vNBܰgpu䘦(Źk~*8BԲEG"Q]vĞA[	+T=nd\J=sk0W2Ek_@?֎ZX!aVq 


gGA
q"Úq(
M<@@
M/@d\J||=vr1W2E<w@@9u"
;f[d\J&=sk0W2EI2@?0HR+_(Sd>RGZ6
jG?
GG
d\JT
tt=sk0W2E41_@?J}+e0PjwU&;}
jTQd\Jxx=vr1W2E8>Y@@w(f~3H@
;uʼnۅd\Jܳ=sk0W2E[t@?	Dê%-sXҌ?>P̦:6u9p"U\[a&4# P{z ij\wTYZ|Qd\Jo=sk0W2Eu@?X5Fl_!I6)A
oK	BT_CANCELM8@	BT_CANCELM8@$AZ_HAVEd6:piecesli3822ei3288eeed\J5tt=vr1W2E4-@?W"9v\
tS;@d\JbG	tt=vr1W2E4&@?s"9v\ީ
t;@d\J6tt=vr1W2E4X@?,"9v\/
u
;@d\J||=vr1W2E<c@@9u"],
;[d\J}}=sk0W2E=-@?*cR/	y룬5)
uvHYd\Jtt=vr1W2E4J=@?lH"9v\;
u;@d\JA=sk0W2EEHC@?\AL`$.1Hb
.1M.1OI7´xid\J
tt=vr1W2E4I9@?mL"9v\S
w;@d\J_
tt=vr1W2E41@?r"9v\׃
{;@d\Jtt=sk0W2E4B@?J}+eEPjwU&;}⹧
Qd\Jb
=sk0W2Ea@?AL45.1Hb
.1M.1O>~KH3Pj?&k0&O$ӧ,6m2)mm=9M
Nҟk#W҈G~4;Z{J8d\Jh=sk0W2E[8@?R\DêRgsXҌ?>Pl:6u9p"U\[a&4# P{z ij\wTYZ|Qd\JG=sk0W2EpG#@?n~
rAyDF
ǀ~TD
M=@
M=@@
M8@d\JItt=vr1W2E4m@?"9v\
ǃV;@d\J^x=sk0W2E;@?ZX!|Wݚq 
Dž^A
q"Úq(
M<@
M/@
M/@
,@@d\Jx=sk0W2ExJD@?E~zAy?D	l
Dž^~TD
M=@
M.@@
M.@@
,@d\Jx=sk0W2E!#@?SmpbInn`xPx+
!8@@
!8@
!8@
!8@
!8@
!8@d\Jx=sk0W2E5@?R+_Sd>[GZ
Dž^?
GG

@
@@
@
@
@d\Jx=sk0W2EG@?*T0iڕ*g!E?Og&gR}gWgm
M<@
M'@
M'@
,@d\Jx=sk0W2E@?c0/	y룵5m
Dž^HY
@@
@
@
@
@
@d\Jy=sk0W2ExN@?@c\<J9ADJr"JϩJJJ1JAJ}JJ(*`T#-S-z8bbU'\H=* vY57.&>WX'[Xڟp-f6D(Y=>+d\J-y=sk0W2E=@?[y,|P
P鳑I7bKЦC5"Zei[.aAD}6w)'E&G,_(zE[pm^Ed\J@	=sk0W2EvRq>wb%=:h7R>)}W"xhSk/ntڝ
%ad4:typei6eed\Jכ
=sk0W2E@?@PU.I%k +p
Nj)~Ŝd2PoC!S0r5ƍ[0<^kzдW-b*a!Qt28 V}bl
~id5|wd\J
=sk0W2Exh@???TGd)D#qV
Nj)X
M7@@
M7@
M7@
,@d\J
##=sk0W2E@?!Uv:Lun]P
@
@
@@
@
@
@
@@
@
@@
@@
@@d\J9
=sk0W2EJn@?!&F`_!I6)
Nj)	BT_CANCELM9@
BT_REQUESTM7@@	BT_CANCELM7@@
BT_REQUEST,@d\JU
=sk0W2E@@?F&F9SF0N=,P6֥
2;%='.p8/:;+*^ְU_֔ؗQrq4d	F(
pf"4$oKѯd\Jw	=sk0W2EvGqg>wb
l{7]>)}W"xtSk/ntڝ
%ad4:typei6eed\J||=vr1W2E<{@@+9u"j
;[

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20090714132430.75bb46c8>