From owner-freebsd-questions@FreeBSD.ORG Thu Jun 18 08:36:12 2009 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id D994E1065672 for ; Thu, 18 Jun 2009 08:36:12 +0000 (UTC) (envelope-from valentin.bud@gmail.com) Received: from mail-fx0-f217.google.com (mail-fx0-f217.google.com [209.85.220.217]) by mx1.freebsd.org (Postfix) with ESMTP id 60F318FC16 for ; Thu, 18 Jun 2009 08:36:11 +0000 (UTC) (envelope-from valentin.bud@gmail.com) Received: by fxm17 with SMTP id 17so113737fxm.43 for ; Thu, 18 Jun 2009 01:36:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :from:date:message-id:subject:to:cc:content-type; bh=i6dboNk0KLUgUiR3yAY6auqO3KRsUWcTRSC+XE+lxm4=; b=nxxkB+TOEyO3O/DMj/TxHa+WvP86yknQrcAy0adsJ195nM7ING3bwbZZpbB7yYZmVv flxGdgfJRGJ5oibfGmjmOLeNSyZNTXCWBmzVkVoWW24shrhODRtxvYEMgJZHoiSH4Ane e39iwm0e5x4mLrfXqRQZgAKPn2hqkNoia1oFs= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=Df/uMjjsSFQgbpdhFLtN4QT+h9Ji7joOkL2OA+ckH1dxGkGCYXUAYozWqPwIH7hB7Y hD7I2nAScAEk6NanWbCA7Kecr3Kn+znYCVSZkPBp3KR+UecpUNdZaaXiBHKNI3sRWVni XbOdOUo4RXHo74k4R4YfgKVYS3F9/EQ632Qaw= MIME-Version: 1.0 Received: by 10.103.251.13 with SMTP id d13mr839995mus.114.1245314171160; Thu, 18 Jun 2009 01:36:11 -0700 (PDT) In-Reply-To: <17838240D9A5544AAA5FF95F8D5203160638ABE2@ad-exh01.adhost.lan> References: <17838240D9A5544AAA5FF95F8D5203160638ABE2@ad-exh01.adhost.lan> From: Valentin Bud Date: Thu, 18 Jun 2009 11:35:51 +0300 Message-ID: <139b44430906180135y6969322ai28c729ca815f6915@mail.gmail.com> To: Mike Sweetser - Adhost Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Cc: freebsd-questions@freebsd.org Subject: Re: PF Routing to VPN Device X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jun 2009 08:36:13 -0000 On Wed, Jun 17, 2009 at 10:31 PM, Mike Sweetser - Adhost wrote: > Hello, > > We have a network with a VPN device sitting beside a PF server, both > connected to an internal network. > > PF Server: 10.1.4.1 > VPN Device: 10.1.4.200 > > The VPNs are set up for 10.1.1.0/24 and 10.1.2.0/24, so any traffic to > these networks should be routed to 10.1.4.200. We've set up routes on > the PF server as such. > > We've set up the following rules: > > block in log > pass in on $int_if route-to 10.1.4.200 from 10.1.4.0/24 to { 10.1.1.0/24 > 10.1.2.0/24) > > However, the block in log is catching the return traffic. From pflog > when somebody on the VPN (10.1.2.105) tries to connect to 10.1.4.25 on > port 80: > > 000000 rule 28/0(match): block in on bge1: 10.1.4.25.80 > > 10.1.2.105.3558: [|tcp] > > If we remove the block in log, the traffic works. > > What are we missing? > > Thanks, > Mike Hello Mike, What version on FBSD are you using? The keep state is implicit from 7.0 as far as i know. I might not be right so someone please correct. If that is the case you should add keep state to your rule and see what happens. my 7c, v -- network warrior since 2005