pf (Packet Filter) is the TCP/IP packet filtering firewall subsystem on BSD systems.

learn more… | top users | synonyms

4
votes
2answers
951 views

NAT and source IP filtering in PF, using OpenBSD >= 4.7

I just read a book about PF (The Book Of PF, No Starch), but there's one question not answered by it. If I have a gateway machine using two interfaces, $int_if and $ext_if, and I NAT the packages ...
4
votes
1answer
39 views

PF's keep state on UDP packets = security issue?

During the last few days I've read a lot about PF as a nice alternative to iptables and a much more improved and secure way of filtering. Nevertheless I came across the following statement which I ...
2
votes
1answer
17 views

“persist” attribute in OpenBSD Tables

According to OpenBSD's FAQs on "Tables" (http://www.openbsd.org/faq/pf/tables.html), without the persist attribute, the kernel will automatically remove the table when the last rule referencing ...
2
votes
1answer
1k views

Routing a LAN through OpenVPN on OpenBSD 5.5

I'm configuring an OpenVPN gateway to allow a LAN access to the internet through the tunnel. The gateway is running OpenBSD 5.5-stable amd64 on the PC Engines APU platform. The LAN contains re1, re2, ...
0
votes
1answer
24 views

TLS and Packet Filtering

I want to set up a client wit BSD packet filtering that only allows outgoing 443 connections. Would this do the trick in my pf.conf? block out block in pass out on eth0 inet proto tcp from (eth0) ...
2
votes
0answers
39 views

pf out interface?

I'm trying to figure out how to allow all hosts in $dmz to reach any host when egressing $extif. I can't seem to find the equivalence of netfilters "-o $extif", and I'd like to avoid specifically ...
2
votes
0answers
150 views

FreeBSD pf firewall, new connections severly delayed when nating

I have a newly setup fbsd 9.1 with pf, which itself doesn't experience any slowness when for example downloading a debian iso from my local debian repo (ftp.se.debian.org). Any machine behind it, ...
1
vote
0answers
9 views

OpenBSD's pf: disable network access for a given user, except for ssh.

If we are using the default firewall for OpenBSD, how can we modify it to disable all the network access for a normal user except for one thing: we want to ssh to the user from random hosts! So ...
1
vote
0answers
27 views

Why isn't my nat-to not applied to the pass out rule?

I've a strange problem concerning NAT on an OpenBSD-Box with pf. I've cut down my pf.conf to the following lines: extif = "pcn0" intif = "pcn1" block drop all #Allow all incoming traffic from intif ...
1
vote
0answers
72 views

I have a firewall bridge in pfSense and I want to log only the allowed packet

I have a bridge0 which has members em0 (wan) and vge0 (lan) I connect via ssh on vge0, when I tcpdump -i pflog0 I get the blocked packets from the bridge0, but when I tcpdump -i bridge0 I get both ...
1
vote
0answers
143 views

Perform Cisco's DNS Doctoring on FreeBSD

How to perform a change in the DNS response from a DNS server to be a different IP address than the DNS server actually answered for a given name? ...