Date: Tue, 28 Dec 2021 19:41:45 +0000 From: Shamim Shahriar <shamim.shahriar@gmail.com> To: Alex Thomas <karlthane@gmail.com> Cc: questions@freebsd.org Subject: Re: PF and tun1 Message-ID: <CAOyJeZTLdocx0tKujMU0=CGnDVCQT_Lj9MwE%2BYKJEpLk1Ft4uA@mail.gmail.com> In-Reply-To: <CABMOuVer0Dy1D0sMAjTJCFee%2B9Lpjo8899c6KKOZyHtwZCh%2Bgg@mail.gmail.com> References: <CABMOuVfxHtXzR0EC7P1h1KPYjpyxX9FnTyexLW4sThDpaE8PfA@mail.gmail.com> <5f2cca65-daab-989c-5fd0-6a5373f5bd56@pp.dyndns.biz> <CABMOuVer0Dy1D0sMAjTJCFee%2B9Lpjo8899c6KKOZyHtwZCh%2Bgg@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--0000000000009dacc005d43a0348
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Have you tried reloading pf rules once tun1 is active/up?
On Tue, 28 Dec 2021, 19:35 Alex Thomas, <karlthane@gmail.com> wrote:
> I have tried that, and have commented out the table for rfc6890 and
> the rules for it. Still not having any success.
>
> On Tue, Dec 28, 2021 at 1:28 AM Morgan Wesstr=C3=B6m
> <freebsd-database@pp.dyndns.biz> wrote:
> >
> > On 2021-12-28 02:55, Alex Thomas wrote:
> > > I am trying to get nebula working on tun1 with pf as my firewall. If =
I
> > > turn pf off, everything works. How to I tell pf to ignore / let
> > > everything pass on the tun1 device.
> > >
> > > vtnet0 =3D "vtnet0"
> > > nebula1 =3D "tun1"
> > > icmp_types =3D "{ echoreq unreach }"
> > > table <bruteforce> persist
> > > table <rfc6890> { 0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8
> > > 169.254.0.0/16 \
> > > 172.16.0.0/12 192.0.0.0/24 192.0.0.0/29
> 192.0.2.0/24
> > > 192.88.99.0/24 \
> > > 192.168.0.0/16 198.18.0.0/15 198.51.100.0/24
> > > 203.0.113.0/24 \
> > > 240.0.0.0/4 255.255.255.255/32 }
> > >
> > > set skip on lo0
> > > set skip on tun1
> > > set skip on $nebula1
> > > scrub in all fragment reassemble max-mss 1440
> > > antispoof quick for $vtnet0
> > > block in quick on egress from <rfc6890>
> > > block return out quick on egress to <rfc6890>
> > > block all
> > > pass in on $vtnet0 proto tcp to port { 22222 } \
> > > keep state (max-src-conn 15, max-src-conn-rate 3/1, \
> > > overload <bruteforce> flush global)
> > > pass out proto { tcp udp } to port { 22 53 80 123 443 }
> > > pass out inet proto icmp icmp-type $icmp_types
> > >
> >
> > In my experience the skip rules only work on interfaces that are
> available when
> > pf starts, which excludes tun-interfaces. I don't know if this is by
> design.
> > Remove your skip rules for tun1 and $nebula1 and just add a pass rule
> for that
> > interface:
> >
> > pass on tun1 all
> >
> > Additionally, since you're quick blocking all traffic to and from
> private IP
> > addresses, make sure you don't use any of those IP addresses on tun1.
> >
> > /Morgan
> >
>
>
--0000000000009dacc005d43a0348
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"auto">Have you tried reloading pf rules once tun1 is active/up?=
</div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">=
On Tue, 28 Dec 2021, 19:35 Alex Thomas, <<a href=3D"mailto:karlthane@gma=
il.com">karlthane@gmail.com</a>> wrote:<br></div><blockquote class=3D"gm=
ail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-le=
ft:1ex">I have tried that, and have commented out the table for rfc6890 and=
<br>
the rules for it. Still not having any success.<br>
<br>
On Tue, Dec 28, 2021 at 1:28 AM Morgan Wesstr=C3=B6m<br>
<<a href=3D"mailto:freebsd-database@pp.dyndns.biz" target=3D"_blank" rel=
=3D"noreferrer">freebsd-database@pp.dyndns.biz</a>> wrote:<br>
><br>
> On 2021-12-28 02:55, Alex Thomas wrote:<br>
> > I am trying to get nebula working on tun1 with pf as my firewall.=
If I<br>
> > turn pf off, everything works. How to I tell pf to ignore / let<b=
r>
> > everything pass on the tun1 device.<br>
> ><br>
> > vtnet0 =3D "vtnet0"<br>
> > nebula1 =3D "tun1"<br>
> > icmp_types =3D "{ echoreq unreach }"<br>
> > table <bruteforce> persist<br>
> > table <rfc6890> { <a href=3D"http://0.0.0.0/8" rel=3D"noref=
errer noreferrer" target=3D"_blank">0.0.0.0/8</a> <a href=3D"http://10.0.0.=
0/8" rel=3D"noreferrer noreferrer" target=3D"_blank">10.0.0.0/8</a> <a href=
=3D"http://100.64.0.0/10" rel=3D"noreferrer noreferrer" target=3D"_blank">1=
00.64.0.0/10</a> <a href=3D"http://127.0.0.0/8" rel=3D"noreferrer noreferre=
r" target=3D"_blank">127.0.0.0/8</a><br>
> > <a href=3D"http://169.254.0.0/16" rel=3D"noreferrer noreferrer" t=
arget=3D"_blank">169.254.0.0/16</a>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 \<br>
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 <a href=3D"http://172.16.0.0/12" rel=3D"noreferrer noreferrer" target=
=3D"_blank">172.16.0.0/12</a> <a href=3D"http://192.0.0.0/24" rel=3D"norefe=
rrer noreferrer" target=3D"_blank">192.0.0.0/24</a> <a href=3D"http://192.0=
.0.0/29" rel=3D"noreferrer noreferrer" target=3D"_blank">192.0.0.0/29</a> <=
a href=3D"http://192.0.2.0/24" rel=3D"noreferrer noreferrer" target=3D"_bla=
nk">192.0.2.0/24</a><br>
> > <a href=3D"http://192.88.99.0/24" rel=3D"noreferrer noreferrer" t=
arget=3D"_blank">192.88.99.0/24</a>=C2=A0 =C2=A0 \<br>
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 <a href=3D"http://192.168.0.0/16" rel=3D"noreferrer noreferrer" target=
=3D"_blank">192.168.0.0/16</a> <a href=3D"http://198.18.0.0/15" rel=3D"nore=
ferrer noreferrer" target=3D"_blank">198.18.0.0/15</a> <a href=3D"http://19=
8.51.100.0/24" rel=3D"noreferrer noreferrer" target=3D"_blank">198.51.100.0=
/24</a><br>
> > <a href=3D"http://203.0.113.0/24" rel=3D"noreferrer noreferrer" t=
arget=3D"_blank">203.0.113.0/24</a>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 \<br>
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 <a href=3D"http://240.0.0.0/4" rel=3D"noreferrer noreferrer" target=3D"=
_blank">240.0.0.0/4</a> <a href=3D"http://255.255.255.255/32" rel=3D"norefe=
rrer noreferrer" target=3D"_blank">255.255.255.255/32</a> }<br>
> ><br>
> > set skip on lo0<br>
> > set skip on tun1<br>
> > set skip on $nebula1<br>
> > scrub in all fragment reassemble max-mss 1440<br>
> > antispoof quick for $vtnet0<br>
> > block in quick on egress from <rfc6890><br>
> > block return out quick on egress to <rfc6890><br>
> > block all<br>
> > pass in on $vtnet0 proto tcp to port { 22222 } \<br>
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 keep state (max-src-conn 15, ma=
x-src-conn-rate 3/1, \<br>
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ove=
rload <bruteforce> flush global)<br>
> > pass out proto { tcp udp } to port { 22 53 80 123 443 }<br>
> > pass out inet proto icmp icmp-type $icmp_types<br>
> ><br>
><br>
> In my experience the skip rules only work on interfaces that are avail=
able when<br>
> pf starts, which excludes tun-interfaces. I don't know if this is =
by design.<br>
> Remove your skip rules for tun1 and $nebula1 and just add a pass rule =
for that<br>
> interface:<br>
><br>
> pass on tun1 all<br>
><br>
> Additionally, since you're quick blocking all traffic to and from =
private IP<br>
> addresses, make sure you don't use any of those IP addresses on tu=
n1.<br>
><br>
> /Morgan<br>
><br>
<br>
</blockquote></div>
--0000000000009dacc005d43a0348--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAOyJeZTLdocx0tKujMU0=CGnDVCQT_Lj9MwE%2BYKJEpLk1Ft4uA>