OpenBSD pf problems Post: 302575170

Sponsored Content

Operating Systems BSD OpenBSD pf problems Post 302575170 by John Tate on Sunday 20th of November 2011 08:45:17 PM

11-20-2011

Registered User

OpenBSD pf problems

I am having troubles with this pf configuration, it seems when loaded nothing can access my server on the internal interface for the LAN, I cannot see why, and it's pretty much based off the very standard example in the OpenBSD faq.

When I unload the configuration, I can access the DNS server on the firewall running this configuration. It seems to forward everything through to the Internet, but blocks DNS which makes it pretty useless. I've looked at it at least five times...

Code:

[john@baal ~$ cat /etc/pf.conf
int_if="xl0"
ext_if="tun0"

rothbard="10.0.0.10"
baal="10.0.0.2"
smass="10.0.0.1"

tcp_services="{22}"
icmp_types="echoreq"

set block-policy return
set loginterface $ext_if
set skip on lo

match out on egress inet from !(egress:network) to any nat-to (egress:0)

block in log
pass out quick

antispoof quick for { lo $int_if }

pass in on egress inet proto tcp from any to (egress) \
        port $tcp_services
#After this goes forwarded ports... Probably just use ssh tunnels.

pass in inet proto icmp all icmp-type $icmp_types

What is wrong?

Bonus points if you can tell me how to do this so it only needs to load once, and not be loaded by a shell script after userland pppoe successfully connects.

John Tate

View Public Profile for John Tate

Find all posts by John Tate

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

please help with openbsd 2.9

Please help. I have downloaded the openbsd 2.9 snapshot from ftp.openbsd.org. the following files were downloaded from the snapshot dir. ( the whole dir. was downloaded ) base29,bsd,bsd.rd,cdrom29.fs,cksum,comp29,etc29,all three floppy images,game29,index,install.ata,install.chs...

2. UNIX for Dummies Questions & Answers

OpenBSD: ports

Hi there.. I'm new to openbsd, and I recently tried the ports-system.. I downloaded the ports-tree from ftp, and unpacked it in /usr/ports Then I typed 'make search key=centericq' I got some info about it.. but it wasn't the latest version.. the version I use at my gentoo linux box, is...

3. UNIX for Dummies Questions & Answers

OpenBSD as router?

Hi Right now, my computer is connected directly to the internet.. but I recently got another one, and now I want to use this to share my internet connection to the other one. The new one has openbsd installed.. How should I do? I also need to forward connections on some ports to my old...

4. Filesystems, Disks and Memory

Maxtor vs. OpenBSD

Can't setup OpenBSD 3.4 with Maxtor Diamond Plus 9 80Gb ATA/133 HDD... Install process stops at hardware initialize, before installing... :confused: Any Comments... Thanks

5. BSD

Snort on openbsd

Im trying to gather some info to set up snort on openbsd 3.2, has anyone out there managed to get it up and running ? My initial attempts seem to be quite below par

6. UNIX for Dummies Questions & Answers

OpenBSD Ftp permissions problems - help!!

Hello, Ok I have a couple of little problems that I can't for the life of me work out how to solve. I wasn't involved in setting the server up, I've just "inherited" the support for it. I've done my best to be a good little newbie, researched articles, tried things out and managed to only get...

7. BSD

OpenBSD and wireless

I've just installed OpenBSD on my laptop (IBM Thinkpad T42) and since this is my first time with wireless networking in OpenBSD I'm a bit lost. What I would like to do is connect to a wireless network using WEP or WPA. Where do I place the key and essid?

8. BSD

Trying to get into OpenBSD

I am an eight year Linux user and after getting into an argument with someone about OpenBSD overiding my theory that OS security is 50% OS and 50% admin skill, I decided to try OpenBSD for myself. I've tried BSDs before and haven't been able to get into them for day to dy use, but I am going to...

9. BSD

openbsd-pf

hello , I wondered if anyone could assist me in writing a simple packet filter firewall on my OpenBSD v4.5. All I intend doing is to have two firewalling machine on a separate network : 192.168.1.1 ext_if = xl0 (dhcp) // Internet interface int_if=xl1 // Internatl interface ...

10. UNIX for Dummies Questions & Answers

Qemu Problems: OpenBSD(host) Kali Linux(guest)

As the title suggests I ran into a little problem trying to create a virtual machine of Kali Linux usign Qemu inside OpenBSD. I edited the example Kali Linux gave on their website here to the following for BSD: qemu-system-i386 -hda ./kali.qcow2 -boot d -cdrom ./kali-linux-1.0.5-i386.iso -m...

LEARN ABOUT MOJAVE

tc-matchall

Match-all classifier in tc(8)                                          Linux                                         Match-all classifier in tc(8)

NAME

       matchall - traffic control filter that matches every packet

SYNOPSIS

       tc filter ... matchall [ skip_sw | skip_hw  ] [ action ACTION_SPEC ] [ classid CLASSID ]

DESCRIPTION

       The matchall filter allows to classify every packet that flows on the port and run a action on it.

OPTIONS

       action ACTION_SPEC
              Apply an action from the generic actions framework on matching packets.

       classid CLASSID
              Push matching packets into the class identified by CLASSID.

       skip_sw
              Do  not  process filter by software. If hardware has no offload support for this filter, or TC offload is not enabled for the inter-
              face, operation will fail.

       skip_hw
              Do not process filter by hardware.

EXAMPLES

       To create ingress mirroring from port eth1 to port eth2:

              tc qdisc  add dev eth1 handle ffff: ingress
              tc filter add dev eth1 parent ffff:           
                      matchall skip_sw                      
                      action mirred egress mirror           
                      dev eth2

       The first command creats an ingress qdisc with handle ffff: on device eth1 where the second command attaches a matchall filters on it  that
       mirrors the packets to device eth2.

       To create egress mirroring from port eth1 to port eth2:

              tc qdisc add dev eth1 handle 1: root prio
              tc filter add dev eth1 parent 1:               
                      matchall skip_sw                       
                      action mirred egress mirror            
                      dev eth2

       The  first  command  creats  an egress qdisc with handle 1: that replaces the root qdisc on device eth1 where the second command attaches a
       matchall filters on it that mirrors the packets to device eth2.

       To sample one of every 100 packets flowing into interface eth0 to psample group 12:

              tc qdisc add dev eth0 handle ffff: ingress
              tc filter add dev eth0 parent ffff: matchall 
                   action sample rate 100 group 12

SEE ALSO

       tc(8),

iproute2                                                            21 Oct 2015                                      Match-all classifier in tc(8)