pf (Packet Filter) is the TCP/IP packet filtering firewall subsystem on BSD systems.

learn more… | top users | synonyms

2
votes
1answer
16 views

macos - local port redirection using pfctl and syntax errors

I am running MacOS(really BSD), and I want to redirect certain traffic over an ssh tunnel using a a local forward. Seems easy enough, but I am repeatedly blocked by the ambiguous "/etc/pf.conf:29: ...
0
votes
0answers
17 views

pf.conf syntax error

I copied this pf.conf from a website rdr-anchor "forwarding" load anchor "forwarding" from "/Users/jeff/Documents/pf.rules" and this pf.rules rdr-anchor "forwarding" load anchor "forwarding" from ...
1
vote
1answer
10 views

How to only allow a group for network access?

Using OpenBSD's pf. Question: How can we modify the firewall of OpenBSD to allow ONLY a given group for network access? If somebody isn't in that group, it shouldn't have layer 3 or layer 2 network ...
4
votes
3answers
40 views

OpenBSD's pf: disable network access for a given user, except for ssh.

If we are using the default firewall for OpenBSD, how can we modify it to disable all the network access for a normal user except for one thing: we want to ssh to the user from random hosts! So ...
3
votes
1answer
36 views

Reject packets in pf after a connection consumed a certain amount of traffic

In pf you can limit the bandwidth that is consumed (by for example ssh) using queues. I am hosting a UDP Service (Discard Protocol) which can easily eat up all my traffic when a client transfers ...
3
votes
1answer
97 views

OpenBSD pf NAT rules based on DHCP/DNS

I have a Proxmox installed and an OpenBSD VM in front of all the others to play the role of NAT, firewall, DNS and DHCP. I have a fully functional DNS and DHCP. My DHCP is correctly updating my DNS ...
2
votes
1answer
17 views

“persist” attribute in OpenBSD Tables

According to OpenBSD's FAQs on "Tables" (http://www.openbsd.org/faq/pf/tables.html), without the persist attribute, the kernel will automatically remove the table when the last rule referencing ...
2
votes
1answer
33 views

How do I add more IP addresses to my pf rules?

I wish to have all internet traffic to go through my VPN; when my VPN is disconnected, all internet traffic can not go out of my workstation/desktop (not server). I wish to switch VPN servers of one ...
1
vote
0answers
31 views

Why isn't my nat-to not applied to the pass out rule?

I've a strange problem concerning NAT on an OpenBSD-Box with pf. I've cut down my pf.conf to the following lines: extif = "pcn0" intif = "pcn1" block drop all #Allow all incoming traffic from intif ...
4
votes
1answer
39 views

PF's keep state on UDP packets = security issue?

During the last few days I've read a lot about PF as a nice alternative to iptables and a much more improved and secure way of filtering. Nevertheless I came across the following statement which I ...
1
vote
0answers
84 views

I have a firewall bridge in pfSense and I want to log only the allowed packet

I have a bridge0 which has members em0 (wan) and vge0 (lan) I connect via ssh on vge0, when I tcpdump -i pflog0 I get the blocked packets from the bridge0, but when I tcpdump -i bridge0 I get both ...
2
votes
1answer
329 views

pf blocks all in/out traffic instead of just the one port I wanted to block

I need to block one incoming port with pf. I'm new to pf, and I can't figure out what I'm doing wrong here. Here is my entire rule file, made to block incoming port 22: set block-policy drop pass in ...
0
votes
1answer
25 views

TLS and Packet Filtering

I want to set up a client wit BSD packet filtering that only allows outgoing 443 connections. Would this do the trick in my pf.conf? block out block in pass out on eth0 inet proto tcp from (eth0) ...
6
votes
2answers
2k views

How to block abusive IP addresses with pf in OpenBSD?

We can see from the nginx logs that there is an IP address doing nasty things. How can we block it with a pf command and then later permanently with the /etc/pf.log? How can we block a x.x.x.x/24 ...
2
votes
1answer
1k views

Routing a LAN through OpenVPN on OpenBSD 5.5

I'm configuring an OpenVPN gateway to allow a LAN access to the internet through the tunnel. The gateway is running OpenBSD 5.5-stable amd64 on the PC Engines APU platform. The LAN contains re1, re2, ...
2
votes
1answer
88 views

Can pf be used to modify HTTP Headers and Contents?

I'm looking at options to replace my router with something that offers me more options for content filtering and also content modification. One of the things that I want to do is to modify HTTP ...
1
vote
1answer
204 views

High performance routing with high churn ruleset. What approach is most likely to scale to C10K and beyond?

I've been asked to create a high throughput router using PC / server hardware. I'm modestly familiar with pf, iptables, and tc, but I've never had such high churn and so many rules. I hope you can ...
1
vote
1answer
303 views

Processing FreeBSD's PF logs with tcpdump/sed/awk

I'm running FreeBSD and have PF firewall set up and this is command i use to display daily number of firewall hits (blocked traffic) sudo tcpdump -n -e -tttt -r /var/log/pflog | grep $(date ...
4
votes
1answer
115 views

putting extra hops into traceroute6 on OpenBSD

I'm running OpenBSD, or maybe FreeBSD. I don't have lots of IPv4 addresses to waste, but who doesn't have a few billion of IPv6 ones? How do I add some extra IPv6 hops to a traceroute6, around pf(4) ...
4
votes
1answer
169 views

How do you do NAT port redirection with PF?

In Linux, you can do NAT port redirection with a command like this: iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8000 What is the equivalent with BSD's PF?
2
votes
0answers
39 views

pf out interface?

I'm trying to figure out how to allow all hosts in $dmz to reach any host when egressing $extif. I can't seem to find the equivalence of netfilters "-o $extif", and I'd like to avoid specifically ...
2
votes
0answers
154 views

FreeBSD pf firewall, new connections severly delayed when nating

I have a newly setup fbsd 9.1 with pf, which itself doesn't experience any slowness when for example downloading a debian iso from my local debian repo (ftp.se.debian.org). Any machine behind it, ...
0
votes
2answers
397 views

PF and types of NAT(Network Address Translation)

As you know, at least 3 types of NAT are used. Of course i need to two types of them.DNAT and SNAT. DNAT : hiding server behind NAT, SNAT : hiding your client behind NAT. Question: I read a quick ...
2
votes
2answers
4k views

should I fix “No ALTQ support in kernel” to run the firewall?

I just messed with my pf.conf and ran pf and I got: Enabling pf. No ALTQ support in kernel Of course the fix is to re-compile the kernel, but that article is for freebsd 7. I'm on FreeBSD 9.1 I ...
2
votes
1answer
262 views

How to configure OpenBSD pf to only allow inbound from given countries?

I have an OpenBSD 5.2 box what's running a webserver on port 80 and an SSHD server on port 2222. How can I configure OpenBSD's pf to only allow connections from given countries to port 80 and 2222?
1
vote
0answers
143 views

Perform Cisco's DNS Doctoring on FreeBSD

How to perform a change in the DNS response from a DNS server to be a different IP address than the DNS server actually answered for a given name? ...
4
votes
1answer
5k views

How to configure pfsense to NAT servers?

How can I configure pfsense so it will NAT servers so they can be accessed outside of the company? I tried to play around with the NAT settings, but didn't get anywhere. I want to be able to access ...
4
votes
2answers
984 views

NAT and source IP filtering in PF, using OpenBSD >= 4.7

I just read a book about PF (The Book Of PF, No Starch), but there's one question not answered by it. If I have a gateway machine using two interfaces, $int_if and $ext_if, and I NAT the packages ...
4
votes
1answer
2k views

Is berkeley packet filter ported to linux?

I am doing some research to figure out what distro's of linux contain kernel packet filtering and are compatible with BPF. http://kernelnewbies.org/Linux_3.0 http://lwn.net/Articles/437981/ These ...
4
votes
1answer
266 views

Inserting a nat solution into a network while it's not the gateway

I have tried this a few different ways. Currently trying with pf on freebsd 8.2 I am trying to insert a nat solution into an existing network that will redirect traffic from an outside ip address to ...
3
votes
2answers
942 views

Letting NFS through a FreeBSD PF firewall

I'm trying to configure my firewall (PF) on FreeBSD to let NFS traffic through. I know that NFS uses both TCP and UDP to connect to the client along with a bunch of daemons that use random port ...
7
votes
6answers
725 views

Can I use Unix to load-balance two Linux servers?

I'm trying to work out a solution in my head where two backend linux-servers run HTTP, SMTP, XMPP mirrored and should load balance connections between them. My current solution is an OpenBSD box ...
3
votes
1answer
292 views

Converting a line from a firewall on OpenBSD 4.9 to OpenBSD 4.7

What is the OpenBSD 4.7 equivalent of this line from OpenBSD 4.9 for use with pf? no nat on egress proto udp from 192.168.1.10 port 4672 to any
3
votes
1answer
300 views

Setting up the firewall for amule on OpenBSD 4.7 gateway

I'm trying to properly setup the firewall on my gateway (OpenBSD 4.7) using pf to allow amule (on 10.0.0.104) to operate properly as discussed here: Now I know pf has changed a bit from OpenBSD 4.7 ...
0
votes
1answer
544 views

port redirection with PF under OpenBSD

i need to do a setting a bit unusual. I have 3 machines with public Ips. I want to use one of them as a load balancer for the 2 others. My machine >> machine1 who redirect the connection to machine ...
3
votes
1answer
2k views

iptables/pf rule to only allow XY application/user?

I think there is no iptables/pf solution to only allow an XY application on e.g.: outbound tcp port 80, eth0. So if I have a userid: "500" then how could I block any other communications then the ...