Skip site navigation (1)Skip section navigation (2) 
Date:      Wed, 23 Jul 2008 15:04:06 -0400
From:      Jon Radel <jon@radel.com>
To:        Ivan Petrushev <ivanatora@gmail.com>
Cc:        freebsd-pf@freebsd.org
Subject:   Re: Why this rule doesn't score a match?
Message-ID:  <488780A6.4010807@radel.com>
In-Reply-To: <d39744a20807231128j6641996i95ee8fec03053b6e@mail.gmail.com>
References:  <d39744a20807231025w42fc4a99ha1e99be5fd5c76b0@mail.gmail.com>	<48876DAD.9080100@optiksecurite.com>	<d39744a20807231127u11df822rc2022a70b1a1af3e@mail.gmail.com> <d39744a20807231128j6641996i95ee8fec03053b6e@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help 

[-- Attachment #1 --]
Ivan Petrushev wrote:
> Hmmm, yes I'm on FreeBSD 7
> I tried these pass rules before - nothing gets logged.
> I thought traffic is going both TO these ports and FROM these ports.
> Let's take for example a simple HTTP connection. The browser
> communicates to the remote server trough remote port 80 and says 'GET
> /index.html', then closes the connection. The HTTP server on the
> remote side opens a connection to the local machine (on some of our
> local port range)... but what is the port number on his side? I think
> that it is again 80.
> About pass in/pass out - I think that in/out keyword can be dropped?
> PF can do without that, right?
> 
> These are my current filter rules, still nothing gets logged:
> ##############################
> pass log on $if proto tcp from any port $tcp_services
> pass log on $if proto udp from any port $udp_services
> pass log on $if proto tcp from any to $ext_ip port $tcp_services
> pass log on $if proto udp from any to $ext_ip port $udp_services
> #############################

HTTP doesn't work like that.  The client opens a connection from an 
arbitrary port (generally high and pseudo-random) to port 80 (or 8080, 
or whatever the published port the server listens on is).  The server 
does NOT open a connection to you.

Your initial packet to the web server

from YOU port NNNN
to SERVER port 80

never gets through your rule set so there's never a response from the 
server to get logged.

You'd do much better, if this is a workstation on which you run a 
webbrowser and other clients, rather than a router/firewall, to do 
something like:

pass out on $if proto tcp to any port $tcp_services flags S/SA keep state

This allows the initial packet from your machine out and uses the PF 
state mechanism (which you really, really, really should be using for 
reasons of efficiency and security) to allow all further packets for 
that TCP connection both in and out on that interface.

Unless you're offering services on this computer to which you want other 
machines to establish connections, you're much better off having no, or 
minimal, "pass in" rules.  That way people can't send you random, 
possibly nasty, packets which you accept simply because they used a 
source port of 80.

--Jon Radel

[-- Attachment #2 --]
0	*H
010	+0	*H
	100\mtv0
	*H
0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA0
080324165921Z
090324165921Z0^10URadel10U*
Jon Thomas10UJon Thomas Radel10	*H
	
jon@radel.com0"0
	*H
0
t,Pp#
٬q_2=L-^m>z3ʟV![([ AoE}ϛ3/6?񥃮cWx(/)'$6sTl<*i'=uoxMbt
rdtnxud1R6T>zU0FZ,vN9NP{>qE`^P;	*Wg/jN*OVՠQMB(=:
*0(0U0
jon@radel.com0U00
	*H
h!oܨ[А!fN#[Z
b$3?x&$~Ħ9}`MX[It}/bXZajgxɥ' 2NrtWAr sFި'^@mDVw\)00\mtv0
	*H
0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA0
080324165921Z
090324165921Z0^10URadel10U*
Jon Thomas10UJon Thomas Radel10	*H
	
jon@radel.com0"0
	*H
0
t,Pp#
٬q_2=L-^m>z3ʟV![([ AoE}ϛ3/6?񥃮cWx(/)'$6sTl<*i'=uoxMbt
rdtnxud1R6T>zU0FZ,vN9NP{>qE`^P;	*Wg/jN*OVՠQMB(=:
*0(0U0
jon@radel.com0U00
	*H
h!oܨ[А!fN#[Z
b$3?x&$~Ħ9}`MX[It}/bXZajgxɥ' 2NrtWAr sFި'^@mDVw\)0?0
0
	*H
010	UZA10UWestern Cape10U	Cape Town10U
Thawte Consulting1(0&UCertification Services Division1$0"UThawte Personal Freemail CA1+0)	*H
	personal-freemail@thawte.com0
030717000000Z
130716235959Z0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA00
	*H
0Ħ<UsUNʙZhup[v:aQP
0cZ,p+Z?qV˯<6$*+w=+>@dקe*TH<a@dr`00U00CU<0:08642http://crl.thawte.com/ThawtePersonalFreemailCA.crl0U0)U"0 010UPrivateLabel2-1380
	*H
HP.
fgCL!6-6/P p<ab:~t%Pb'qW%ݩ9 Oe_N4[5MwV!x!5$F]_eO1d0`0v0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAmtv0	+0	*H
	1	*H
0	*H
	1
080723190406Z0#	*H
	1&ݨ[0R	*H
	1E0C0
*H
0*H
0
*H
@0+0
*H
(0	+71x0v0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAmtv0*H
	1xv0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAmtv0
	*H
jv _}{$IW2k/!#3s{&n\~79
зr86z;<l@,RqH=yN@ς~ڌ~^!
hgJ<ػjPٴ>>M;%&{&4 *={36ϢAd7Lg:9+Etщy0Ԩk~fu;/o0KuB8v<

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?488780A6.4010807>