From owner-freebsd-questions@FreeBSD.ORG Thu Aug 7 12:12:44 2014 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 8464766A for ; Thu, 7 Aug 2014 12:12:44 +0000 (UTC) Received: from mail-ob0-f182.google.com (mail-ob0-f182.google.com [209.85.214.182]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4FF172001 for ; Thu, 7 Aug 2014 12:12:43 +0000 (UTC) Received: by mail-ob0-f182.google.com with SMTP id wm4so2813001obc.41 for ; Thu, 07 Aug 2014 05:12:37 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:date:message-id:subject:from:to :content-type; bh=8zL3hs3FfImvhk0dPcFGotcaq1N4GFpaaBsAxa+8ebw=; b=UVcFN/Ja9W9FnfEM00ZNHXYz+oqJZEtgpVKekQlP0RCBnS+32I5YQQsHiBN+pP2r2O La4g26BzT51ylgnop4Vd+zaKbSMheo+iRHwX04w0Hj3rx+zcG5ziBkD0Jcxyu/f8MzEB G+8RMeECNRxt86D1GvJVi4r55RH9N+oFqYtIcPWCEclJIOnNGBTMumx6LtGfKnzyu5Fj Jm1xSpra8mOWH1kwoQnwBJsZWydMuVPq119XeeF7U8NI2WtTvKvqkLbM32DLJU6XOO2v vDt0UsKNmtzjErj302x0mi9P+Fd4OQe13tNhuZPmkyS+oOfGPkesKZUgazsCfxbF3CGp Ekxg== X-Gm-Message-State: ALoCoQncAKpOKRGEbXEWag6eOG9omOgNl0ggc3ke6i85/wJ7C2NR+Duy4GedimmxnE4tiFOHQWJo MIME-Version: 1.0 X-Received: by 10.182.65.65 with SMTP id v1mr23015754obs.58.1407413557208; Thu, 07 Aug 2014 05:12:37 -0700 (PDT) Received: by 10.76.68.230 with HTTP; Thu, 7 Aug 2014 05:12:37 -0700 (PDT) Date: Thu, 7 Aug 2014 13:12:37 +0100 Message-ID: Subject: correctly configuring PF with jailed environments From: Norman Khine To: freebsd-questions@freebsd.org Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.18 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Aug 2014 12:12:44 -0000 hello, i have a web application running 3 jail environments one for Nginx Web server, one for MongoDB/Redis and one for my Node.js application this is my current pf.conf file https://gist.github.com/nkhine/d03ea23a749c47bcc4d0 this works, as there is no access to my node app nor any of the dbs from public interfaces. the rules come out as # pfctl -s rules scrub out log on igb0 all random-id min-ttl 15 set-tos 0x1c fragment reassemble scrub in log on igb0 all min-ttl 15 fragment reassemble scrub in all fragment reassemble i find that on my webserver i get timeouts and the applicationd does not load up quickly! also, are there any improvements i can make to this as to ensure a more secure environment? any advice much appreciated -- %>>> "".join( [ {'*':'@','^':'.'}.get(c,None) or chr(97+(ord(c)-83)%26) for c in ",adym,*)&uzq^zqf" ] )