Date: Mon, 10 Mar 2014 14:56:51 -0400 From: Jason Hellenthal <jhellenthal@dataix.net> To: =?utf-8?Q?Ermal_Lu=C3=A7i?= <eri@freebsd.org> Cc: Joe Nosay <superbisquit@gmail.com>, John-Mark Gurney <jmg@funkthat.com>, "freebsd-net@freebsd.org" <freebsd-net@freebsd.org> Subject: Re: Using pf.conf with public access points. Message-ID: <71CCF277-8BF7-4C3B-9F9E-2095EA4CC060@dataix.net> In-Reply-To: <CAPBZQG3jzWnLk_Ea-VwkpTg2wHCF21M4faKzsYfVDAy9SAw3mg@mail.gmail.com> References: <CA%2BWntOsQG-OeF8AmiftKt6-7upXTN7Pnv4ogZJmt6kjZ0GsZAA@mail.gmail.com> <20140309231829.GG32089@funkthat.com> <9C40270E-18E0-4993-B7C5-BD8B5A24C95D@dataix.net> <CAPBZQG3jzWnLk_Ea-VwkpTg2wHCF21M4faKzsYfVDAy9SAw3mg@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] I nearly forgot all about that feature thank you for the reminder. -- Jason Hellenthal Voice: 95.30.17.6/616 JJH48-ARIN > On Mar 10, 2014, at 10:20, Ermal Luçi <eri@freebsd.org> wrote: > > Usually pf(4) does support having dynamic ips inside its ruleset. > For example just putting the interface name as address or putting $iface:0 for first address etc... > > Take a look an man page of pf.conf and search for the string 'Interface names and interface group names can' > > >> On Sun, Mar 9, 2014 at 11:27 PM, Jason Hellenthal <jhellenthal@dataix.net> wrote: >> You'll want to not use up addresses in your pf.conf >> >> Block on default and then open up by definition of ports instead. Forget the whole IPAddr thing and treat this as a roaming client firewall. >> >> >> -- >> Jason Hellenthal >> Voice: 95.30.17.6/616 >> JJH48-ARIN >> >> > On Mar 9, 2014, at 19:18, John-Mark Gurney <jmg@funkthat.com> wrote: >> > >> > Joe Nosay wrote this message on Sun, Mar 09, 2014 at 15:36 -0400: >> >> 2. How do I compensate for the use of public access points when the IP >> >> addresses will always be different? >> > >> > it doesn't appear that pf has this ability, but it looks like ipfw >> > has this, from ipfw(8): >> > me matches any IP address configured on an interface in the >> > system. >> > >> > So, maybe switching to ipfw might be an option.. >> > >> > -- >> > John-Mark Gurney Voice: +1 415 225 5579 >> > >> > "All that I will do, has been done, All that I have, has not." >> > _______________________________________________ >> > freebsd-net@freebsd.org mailing list >> > http://lists.freebsd.org/mailman/listinfo/freebsd-net >> > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org" > > > > -- > Ermal [-- Attachment #2 --] 0 *H 01 0 + 0 *H 90000 *H 01 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA0 130518085048Z 140519220947Z0H1 0 U jhellenthal@dataix.net1%0# *H jhellenthal@dataix.net0"0 *H 0 '`TmfkܨJ5u +c'Upb`zv)&ȸXZ*VN6JvLoVoh}g pQDŽKf/tZA˳( "4Ԅ˻'d2h| IBl' ^v^;'e8S99ۿVm|k8_UQtC"5l!kjZ]އQGn \Bh!F TsD%pV^Eӑd¨x"9 г" f 00 U 0 0 U 0 U %0++0 U ڔfmVʢ$䟓0 U #0Sr풜\|~5NԸQ0!U 0jhellenthal@dataix.net0LU C0?0; +70*0.+"http://www.startssl.com/policy.pdf0+00' StartCom Certification Authority0This certificate was issued according to the Class 1 Validation requirements of the StartCom CA policy, reliance only for the intended purpose in compliance of the relying party obligations.06U /0-0+)'%http://crl.startssl.com/crtu1-crl.crl0+009+0-http://ocsp.startssl.com/sub/class1/client/ca0B+06http://aia.startssl.com/certs/sub.class1.client.ca.crt0#U 0http://www.startssl.com/0 *H {0Ӹ,52W{Ey8b [ {7 _+P"n["-,@ŽpJ-W$ݍjWA-6z( RdIZ. KzXє[ K6}{s+v.Qh0PͅK hTw 0I73lz*K v4Kkگ63;p1:ױ@)]ok>:W%XwC1þL/o8~#oP040 0 *H 0}1 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1)0'U StartCom Certification Authority0 071024210155Z 171024210155Z01 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA0"0 *H 0 -).2AUGo#G B|NDRpM-B=o -we5JQpa>O.#._<V [~**pz~3WG .ᘟMlr[<Ce6fqO"uxfWN#uicgkv$Lb%y`_{`xK'GN 00U 00U 0 U Sr풜\|~5NԸQ0 U #0N @[i04hCA0f+Z0X0'+0http://ocsp.startssl.com/ca0-+0!http://www.startssl.com/sfsca.crt0[U T0R0'%#!http://www.startssl.com/sfsca.crl0'%#!http://crl.startssl.com/sfsca.crl0U y0w0u +70f0.+"http://www.startssl.com/policy.pdf04+(http://www.startssl.com/intermediate.pdf0 *H }x,\c^ #wMq}>UK/^yX֏y frMIŲB61ymQҨݬZ0& ;@#13qۑ& ̢o 6r_;GO>*I( 74XS1r3)!LJy6Kotˆ# _wSr ;B ADp(fs 䰷6%.W0J3:bC<8t X1<Cn=t==wST~\wkBf|15zUP)(IjVB!OfI=bb\4-*em/нSJm7N[]'@ڽ D9Kr>R7/|o^I@ټ'Pa $ z9a'L)( I}vcH]۸D*W} m>Q|C.(,lQ000 *H 0}1 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1)0'U StartCom Certification Authority0 060917194636Z 360917194636Z0}1 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1)0'U StartCom Certification Authority0"0 *H 0 lF|x{3rb6 "$^wC d̎68#nm<r =3+/AYg} tyL7z9RYFC҅qub4, 4ǖR=3M ;JK&/ r5w<]&6v\t%x- 0-ryF*I cSb:̵fkt+v>mDsb ;ľSV%lQ ʿvmۿ=f VH:KߧXP8u[C lMp[)eݪ]̯1 ҍ{n'f HnB?!>{ pclT\%zɢɋ,~^MXn 2n6IHiMi y"H{ipz7 vOW`g:ԋr"Ɵƶ\R<*s `z/ۣn&0݉W=+ŷv+*r3] KtRK R0N0 U 00 U 0 U N @[i04hCA0dU ]0[0,*(&http://cert.startcom.org/sfsca-crl.crl0+)'%http://crl.startcom.org/sfsca-crl.crl0]U T0P0L +70;0/+#http://cert.startcom.org/policy.pdf05+)http://cert.startcom.org/intermediate.pdf0+00' Start Commercial (StartCom) Ltd.0Limited Liability, read the section *Legal Limitations* of the StartCom Certification Authority Policy available at http://cert.startcom.org/policy.pdf0 `HB 08 `HB +)StartCom Free SSL Certification Authority0 *H lf 4Ѕ^} N8 ^ߦ%K2;=D [I)f% <6+Kh9f=&9 Q{~ZWpi^X ߌE8 ^Wbz )n(DÐ8<CMdE(\s{諱.\dns1:}Q;Mf{<Ӛ ePu/CiyCFrd6% 8w~kjDKx, KD4R' ]xS2݀fuٵh(a.8 gd./pǖ|eCTݥ9`4ɖp, H{ ~k";*RKU"4N&",uJ} d6/# ;sIjWxřCcMw-eriG V$ yX. ~m >J9+u U77Cb VKel$$4"}?eQ 0j r^1o0k001 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA0 + 0 *H 1 *H 0 *H 1 140310185653Z0# *H 1j#6l$"G0 +71001 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA0 *H 101 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA0 *H (fr; X355 ,OJ*@($خggyǞ1MO]stαZ)1<&SY`?nF@wI Zǹdj߃]A<a[GC4/(T@?W*/Y9* emlݕ_H<l[cS0 -ÄQTiȎ,i{d&'9V"1 %r' @ O!|^
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?71CCF277-8BF7-4C3B-9F9E-2095EA4CC060>