pf (Packet Filter) is the TCP/IP packet filtering firewall subsystem on BSD systems.

learn more… | top users | synonyms

4
votes
2answers
2k views

NAT and source IP filtering in PF, using OpenBSD >= 4.7

I just read a book about PF (The Book Of PF, No Starch), but there's one question not answered by it. If I have a gateway machine using two interfaces, $int_if and $ext_if, and I NAT the packages ...
0
votes
2answers
19 views

Messed up my mac firewall configuration (pf.conf) and ended up with 100% packet loss

I was trying to do wifi throttling for my new app development (new to this) and was trying to do it using iceFloor application. I'm not 100% sure if this is a problem, but i need to confirm if i ...
0
votes
2answers
43 views

Block IP if it connects to port 22

How can I effectively (so do it fast when talking about firewall level and can do it with many-many IP's) block an IP address for a given time, ex.: a month if it tried to contact port 22 TCP in any ...
4
votes
1answer
108 views

PF's keep state on UDP packets = security issue?

During the last few days I've read a lot about PF as a nice alternative to iptables and a much more improved and secure way of filtering. Nevertheless I came across the following statement which I ...
1
vote
1answer
23 views

How to only allow a group for network access?

Using OpenBSD's pf. Question: How can we modify the firewall of OpenBSD to allow ONLY a given group for network access? If somebody isn't in that group, it shouldn't have layer 3 or layer 2 network ...
0
votes
1answer
24 views

set up pfctl to forbid local applications accessing a specific hostname

I am an OSX user, and I want to ban some hostnames, with which some local applications may do nasty things. pfctl is the default firewall on OSX 10.11 El captain. So, how to block the specific ...
0
votes
1answer
63 views

TLS and Packet Filtering

I want to set up a client wit BSD packet filtering that only allows outgoing 443 connections. Would this do the trick in my pf.conf? block out block in pass out on eth0 inet proto tcp from (eth0) ...
3
votes
0answers
65 views

Accessing ports on public IP from within a FreeBSD jail

In a FreeBSD 10 setup, I have a jail running the publicly accessible nginx web server and another jail for the Java backend server based on Jetty. Each jail has its own internal IP address 127.0.1.x ...
2
votes
0answers
28 views

pfctl - How to forward ip address in Mac OS Yosemite

How to forward all traffic to an external site 172.16.19.211:5001 to 127.0.0.1:5000 ? These docs have details about port forwarding but still ip forwarding is unclear. ...
2
votes
0answers
108 views

Why isn't my nat-to not applied to the pass out rule?

I've a strange problem concerning NAT on an OpenBSD-Box with pf. I've cut down my pf.conf to the following lines: extif = "pcn0" intif = "pcn1" block drop all #Allow all incoming traffic from intif ...
2
votes
0answers
50 views

pf out interface?

I'm trying to figure out how to allow all hosts in $dmz to reach any host when egressing $extif. I can't seem to find the equivalence of netfilters "-o $extif", and I'd like to avoid specifically ...
2
votes
0answers
196 views

FreeBSD pf firewall, new connections severly delayed when nating

I have a newly setup fbsd 9.1 with pf, which itself doesn't experience any slowness when for example downloading a debian iso from my local debian repo (ftp.se.debian.org). Any machine behind it, ...
1
vote
0answers
335 views

Can not divert packet to pf when configure transparent squid 3.4.13 on OpenBSD 5.7

I am trying to build transparent proxy with squid on OpenBSD 5.7 with pf firewall. I compile squid from sources with options: $ squid -v Squid Cache: Version **3.4.13** configure options: ...
1
vote
0answers
257 views

I have a firewall bridge in pfSense and I want to log only the allowed packet

I have a bridge0 which has members em0 (wan) and vge0 (lan) I connect via ssh on vge0, when I tcpdump -i pflog0 I get the blocked packets from the bridge0, but when I tcpdump -i bridge0 I get both ...
1
vote
0answers
182 views

Perform Cisco's DNS Doctoring on FreeBSD

How to perform a change in the DNS response from a DNS server to be a different IP address than the DNS server actually answered for a given name? ...
0
votes
0answers
12 views

pcfl - Allow ssh for an specific IP

I'm working with pfctl on Mac OS X. Im trying to make a policy/anchor what blocks SSH for ALL ips, minus specific ip. I try this: pass in on fxp0 proto tcp from any to any port < 22 flags S/SA ...
0
votes
0answers
102 views

Configure FreeBSD pf firewall (non GUI) for beginner

I am running Mac OS X 10.10, but my research has led me to the understanding that the particular flavor of pf was ported from FreeBSD. I have tried the popular GUI software (IceFloor) but it is a bit ...