From owner-freebsd-pf@FreeBSD.ORG Sat Mar 25 09:48:08 2006 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id F19EB16A400 for ; Sat, 25 Mar 2006 09:48:08 +0000 (UTC) (envelope-from freebsd-stable@chef-ingenieur.de) Received: from mta.webmatic.de (mta.webmatic.de [212.78.99.126]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0A0BB43D46 for ; Sat, 25 Mar 2006 09:48:07 +0000 (GMT) (envelope-from freebsd-stable@chef-ingenieur.de) Received: (qmail 26543 invoked by uid 89); 25 Mar 2006 09:48:04 -0000 Received: by simscan 1.1.0 ppid: 26537, pid: 26539, t: 0.9694s scanners: attach: 1.1.0 clamav: 0.87.1/m:34/d:1205 spam: 3.1.0 X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on mta.webmatic.de X-Spam-Level: X-Spam-Status: No, score=0.0 required=5.0 tests=none autolearn=ham version=3.1.0 Received: from unknown (HELO ?192.168.168.2?) (freebsd-stable@chef-ingenieur.de@217.188.193.85) by mta.webmatic.de with (DHE-RSA-AES256-SHA encrypted) SMTP; 25 Mar 2006 09:48:03 -0000 Message-ID: <442511D3.6080408@chef-ingenieur.de> Date: Sat, 25 Mar 2006 10:48:03 +0100 From: Thomas Krause User-Agent: Thunderbird 1.5 (Windows/20051201) MIME-Version: 1.0 To: freebsd-pf@freebsd.org Content-Type: text/plain; charset=ISO-8859-15; format=flowed Content-Transfer-Encoding: 7bit Subject: "unknown" ICMP packets on tun0 X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Mar 2006 09:48:09 -0000 Hello, I build an ADSL gateway with ppp and pf. I used the pf example from the OpenBSD faq for my ruleset. Now I get lots of ICMP blocks 000000 rule 2/0(match): block in on tun0: x.y.193.85 > x.y.193.85: [|icmp] 1. 005880 rule 2/0(match): block in on tun0: x.y.193.85 > x.y.193.85: [|icmp] 1. 309811 rule 2/0(match): block in on tun0: x.y.193.85 > x.y.193.85: [|icmp] 1. 999694 rule 2/0(match): block in on tun0: x.y.193.85 > x.y.193.85: [|icmp] 1. 999688 rule 2/0(match): block in on tun0: x.y.193.85 > x.y.193.85: [|icmp] 1. 999702 rule 2/0(match): block in on tun0: x.y.193.85 > x.y.193.85: [|icmp] I've no idea, what causes the ICMP packets. The IP address is the address I got from the ISP. This is my ruleset: int_if = "fxp0" ext_if = "tun0" merlin = "172.16.4.4" icmp_types = "echoreq" priv_nets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }" comp3 = "192.168.168.2" set block-policy return set loginterface $ext_if set skip on lo0 scrub in all nat on $ext_if from $int_if:network to any -> $ext_if rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021 rdr on $ext_if proto tcp from any to any port 80 -> $comp3 block out all block in all block in log on $ext_if all block drop in quick on $ext_if from $priv_nets to any block drop out quick on $ext_if from any to $priv_nets pass in on $ext_if inet proto tcp from any to $ext_if \ port auth flags S/SA keep state pass in on $ext_if inet proto tcp from $merlin to $ext_if \ port { smtp, ssh } flags S/SA keep state pass in on $ext_if proto tcp from any to $comp3 port 80 \ flags S/SA synproxy state pass in on $ext_if inet proto tcp from port 20 to $ext_if \ user proxy flags S/SA keep state pass in inet proto icmp all icmp-type $icmp_types keep state pass in on $int_if from $int_if:network to any keep state pass out on $int_if from any to $int_if:network keep state pass out on $ext_if proto tcp all modulate state flags S/SA pass out on $ext_if proto { udp, icmp } all keep state Any idea? Kind regards, Thomas.