From owner-freebsd-questions@FreeBSD.ORG Tue Sep 18 02:30:17 2007 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 6983D16A418 for ; Tue, 18 Sep 2007 02:30:17 +0000 (UTC) (envelope-from agus.262@gmail.com) Received: from py-out-1112.google.com (py-out-1112.google.com [64.233.166.178]) by mx1.freebsd.org (Postfix) with ESMTP id EC2A213C4D9 for ; Tue, 18 Sep 2007 02:30:16 +0000 (UTC) (envelope-from agus.262@gmail.com) Received: by py-out-1112.google.com with SMTP id u77so3530963pyb for ; Mon, 17 Sep 2007 19:30:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:references; bh=IyRKKwVuOQiG7fhiMJMfCI3jPsvgi9nSIO4ImRS7Otk=; b=hW1qiEKjv5Rw/SHuT0WaXy0ZO2m/j3PRQt0Da9kPeVAgaX+8d5COp9Z7x0VTloR38Gs46vraDKrPcpGObpXATPEZOYs0BOY5yqf3Z//OCXPBuzPOjjxouv22oTrwfnhabwGtfhv0TJVQlwAwaPOxVIxrvtNgOnl/VF3Vjnb5vJA= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:references; b=XJdrTqo/fEVm3f26V2YONhbUTWkXKKnxjioZIDJhw4I1I6Mvis+XyDIkLXnRS6S0HJiw03p1b4h3XPOzOVD2BX7KOkOeMo5v4SlpJoWVPUOHxbmNinLL2BZZtPTwAMZ45Tr/eiBolnKbAge+r5jc4sq9tFDRQw5lOdZx5hoVe5U= Received: by 10.35.84.9 with SMTP id m9mr7134328pyl.1190082603491; Mon, 17 Sep 2007 19:30:03 -0700 (PDT) Received: by 10.35.83.16 with HTTP; Mon, 17 Sep 2007 19:30:03 -0700 (PDT) Message-ID: Date: Mon, 17 Sep 2007 23:30:03 -0300 From: Agus To: support@kinetix.gr In-Reply-To: <46EEB13C.4020509@kinetix.gr> MIME-Version: 1.0 References: <200709152336.27214.fbsd.questions@rachie.is-a-geek.net> <46EEB13C.4020509@kinetix.gr> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Cc: freebsd-questions@freebsd.org Subject: Re: How to add rule with pfctl... X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Sep 2007 02:30:17 -0000 Agus wrote: > > 2007/9/15, Mel : > > On Saturday 15 September 2007 23:18:17 Agus wrote: > > I am trying to figure out how to add a firewall rule with pfctl... > This is what i'm trying to do... > > I've got SEC that matches certain pattern and takes the IP from that and > want to trigger a firewall rule to block that IP.... > Then after a couple of hours SEC will trigger the command to un-block > > the > > IP... > So what i need is the command to block an IP address from command line, > > not > > touching any pf.conf.... > > If you don't need to add a rule but an IP, then tables are your friend. > Example for /etc/pf.conf: > # Placeholder for spammers table, non-routable network IP. > table persist { 192.168.111.111 } > # Block this traffic > block return-rst in log on $ext_if proto tcp from port smtp > > Then on the command line: > /sbin/pfctl -t spammers -Tadd ip.from.new.spammer > And to delete: > /sbin/pfctl -t spammers -Tdel ip.from.old.spammer > > -- > Mel > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org" > > Hi, > I put this on /etc/pf.conf > external_addr="192.168.1.11" which is the address of the only interface. > This machine isn't a router. > > block drop in quick on $ext_if inet proto tcp from 192.168.0.1 to > $external_addr port ssh > > but when i try to connect from 192.168.0.1 i connect with no problems...this > rule is to block access.. > What am i doing wrong..is my first time with pf... > > Thankss... > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org" > > 2007/9/17, Goltsios Theodore : Well I think that you mean to add this: ext_if="rl0" # Or whatever your interface is ifconfig helps to find out block drop in quick on $ext_if inet proto tcp from 192.168.0.1 to $ext_if port ssh or even: ext_if="rl0" external_addr="192.168.1.11" block drop in quick on $ext_if inet proto tcp from 192.168.0.1 to $external_addr port ssh Think of macros as variables. As long as you don't define them they don't exist (are empty). I knowTheodore, i've done it exactly like u put it....first declare macros and then the rule.... but i couldn't block access to the machine....this rule is supposed to block all access to port 22 on the machine coming from 192.168.0.1....but I can access from there... i checked pfctl -e pfctl -sa and everything seems to be loaded... Thanks...