Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 1 Mar 2005 11:25:35 -0600
From:      "Andrew L. Gould" <algould@datawok.com>
To:        freebsd-questions@freebsd.org, Madhusudan Singh <singh.madhusudan@gmail.com>
Subject:   Re: A possibly simple query about pf on FreeBSD 5.3-RELEASE
Message-ID:  <200503011125.35214.algould@datawok.com>
In-Reply-To: <ace7b43805030108447a2b2689@mail.gmail.com>
References:  <ace7b43805030108447a2b2689@mail.gmail.com>

next in thread | previous in thread | raw e-mail | index | archive | help
On Tuesday 01 March 2005 10:44 am, Madhusudan Singh wrote:
> After nearly a week of fighting the dual problem of OpenBSD 3.6
> release freezing on my hardware, and some rather odious personalities
> on the misc@openbsd mailing list, I decided to install FreeBSD
> 5.3-RELEASE on the web server I am deploying and stick to it.
>
> I went through the webpage on firewalling on FreeBSD
> (http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls-
>pf.html) and decided to pick pf as my firewall solution. The OpenBSD
> guide on this simply and elegantly written and is very easy to get
> the hang of.
>
> I have created a packet filtering ruleset in /etc/pf.conf, enabled
> the switches in /etc/rc.conf and am fiddling around with it. I tried
> to connect on port ssh (22, I think) and did a few tests with
> different IP addresses and it works as I expect.
>
> Since this beast is going to be a webserver, I wrote the following
> filter for port www :
>
> (previously blocking all and scrubbing all of course)
>
> pass in on $ext_if proto tcp from any to $ext_if \
>  port www flags S/SA keep state \
> (max 200,source-track rule,max-src-nodes 100,max-src-states 3)
>
> Question :
>
> Is the above a reasonably good rule for my situation (if you have
> further questions, fire away) ?
>
> Second, whenever I load my rule set (pfctl -f /etc/pf.conf), I get a
> warning :
> No ALTQ support in kernel
> ALTQ related functions disabled
>
> Now, I would probably want to use queueing and bandwidth allotment if
> I am to run a webserver that allows a few IP addresses to connect via
> ssh.
>
> Question :
>
> How do I enable ALTQ support in the kernel ? And since I have the

Add the following line to your kernel configuration file and 
compile/install a new kernel.

options	ALTQ

For instructions regarding kernel configuration/installation, see 
Chapter 8 of the online manual:

http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/kernelconfig.html

> choice of either using a loadable module for pf (like I am doing) or
> compiling in PF support into the kernel, which is better from a
> security and performance pov ?

pf is compiled into the GENERIC kernel by default in FreeBSD 5.3.

>
> Another issue, unrelated to pf :
>
> I am trying to install plone, zope (and a bunch of zope/plone related
> packages) and apache on the machine. However, the pkg_add process
> quit with some errors for some of the packages and refered me to some
> log (which log ?) during installation.
>
> Question :
>
> Are versions in the ports tree for these packages "kosher", i.e., do
> they compile, install and work cleanly ?

Best of luck,

Andrew Gould



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200503011125.35214.algould>