Date: Mon, 4 Dec 2006 12:36:09 +0100 From: "Niklas Saers" <niklassaers@gmail.com> To: "Daniel Bye" <freebsd-questions@slightlystrange.org>, freebsd-pf@freebsd.org Subject: Re: newbie to pf Message-ID: <491ac4fb0612040336t2a7d2d40xaee0be24166ad593@mail.gmail.com> In-Reply-To: <20061204062158.GA57910@catflap.slightlystrange.org> References: <491ac4fb0612030325x2bbbb88br65ad4c3a2f4c8f43@mail.gmail.com> <20061204062158.GA57910@catflap.slightlystrange.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi guys,
On 12/4/06, Daniel Bye <freebsd-questions@slightlystrange.org> wrote:
> From reading the excellent documentation at the OpenBSD site, I think
> you are missing a `pass' rule for your redirected traffic.
Yes, I was. I've substituted "rdr" for "rdr pass" that I believe
should work great for ssh, https and mysql.
> Remember that the filtering engine will
> see the redirected packets /after/ translation occurs, so take that
> into account if you write dedicated rules.
Thanks for the heads-up there, at the time I wrote this I didn't think
of that. Been doing much reading since then, and as you point out,
that's an excelent documentation.
> As for your ssh problem - this may be related to a DNS timeout.
It was indeed. :-)
The main problem turned out to be the ADSL router, not pf. The
forwarded data was not being forwarded correctly, but a flash update
and reconfig later the data are coming in fine and being forwarded
just fine.
What I'm wondering about now is: what weaknesses are there in my
setup? Is there anything I should be particularly aware of?
# macros
ext_if = "sis0"
int_if = "sis1"
bus_if = "sis2"
internal_net = "10.0.2.0/24"
business_net = "10.0.3.0/24"
soekris = "{ 10.0.0.4, 10.0.2.1, 10.0.3.1 }"
# tables
table <firewall> const { self }
# options
set block-policy drop
set state-policy if-bound
#set require-order yes
#set fingerprints "/etc/pf.os"
#set loginterface $ext_if
# scrub incoming packets
set skip on lo
scrub all reassemble tcp fragment reassemble
# redirection
rdr pass on $ext_if proto tcp from any to any port 22 -> 10.0.3.2
rdr pass on $ext_if proto tcp from any to any port 443 -> 10.0.3.2
rdr pass on $ext_if proto tcp from any to any port 3306 -> 10.0.3.2
# nat
nat on $ext_if from $internal_net to any -> ($ext_if)
nat on $ext_if from $business_net to any -> ($ext_if)
no nat on $ext_if from $internal_net to $business_net
no nat on $ext_if from $internal_net to $soekris
# setup a default deny policy
block drop log all
# pass traffic on the loopback interface in either direction
pass quick on lo0 all
pass quick on $int_if all
pass quick on $bus_if all
# outgoing dns, ntp
pass out quick on $ext_if inet proto udp from ($ext_if) to any port {
53, 123 } keep state
# outgoing from firewall
pass out log quick on $ext_if inet proto tcp from ($ext_if) to any
flags S/SA keep state
pass out log quick on $ext_if inet proto { udp, icmp } from ($ext_if)
to any keep state
# incoming active ftp-data (this is required for active ftp to work)
pass in log quick on $ext_if inet proto tcp from any port 20 to
($ext_if) port >= 1024 flags S/SA keep state
# incoming tcp and udp from the internal network to the internet
pass in log quick on $int_if inet proto tcp from $internal_net to
!<firewall> flags S/SA modulate state
pass in log quick on $int_if inet proto udp from $internal_net to
!<firewall> keep state
pass in log quick on $bus_if inet proto tcp from $business_net to
!<firewall> flags S/SA modulate state
pass in log quick on $bus_if inet proto udp from $business_net to
!<firewall> keep state
Cheers
Nik
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?491ac4fb0612040336t2a7d2d40xaee0be24166ad593>