pf (Packet Filter) is the TCP/IP packet filtering firewall subsystem on BSD systems.

learn more… | top users | synonyms

7
votes
6answers
695 views

Can I use Unix to load-balance two Linux servers?

I'm trying to work out a solution in my head where two backend linux-servers run HTTP, SMTP, XMPP mirrored and should load balance connections between them. My current solution is an OpenBSD box ...
4
votes
1answer
2k views

Is berkeley packet filter ported to linux?

I am doing some research to figure out what distro's of linux contain kernel packet filtering and are compatible with BPF. http://kernelnewbies.org/Linux_3.0 http://lwn.net/Articles/437981/ These ...
4
votes
2answers
645 views

How to block abusive IP addresses with pf in OpenBSD?

We can see from the nginx logs that there is an IP address doing nasty things. How can we block it with a pf command and then later permanently with the /etc/pf.log? How can we block a x.x.x.x/24 ...
4
votes
1answer
4k views

How to configure pfsense to NAT servers?

How can I configure pfsense so it will NAT servers so they can be accessed outside of the company? I tried to play around with the NAT settings, but didn't get anywhere. I want to be able to access ...
4
votes
1answer
252 views

Inserting a nat solution into a network while it's not the gateway

I have tried this a few different ways. Currently trying with pf on freebsd 8.2 I am trying to insert a nat solution into an existing network that will redirect traffic from an outside ip address to ...
4
votes
1answer
98 views

putting extra hops into traceroute6 on OpenBSD

I'm running OpenBSD, or maybe FreeBSD. I don't have lots of IPv4 addresses to waste, but who doesn't have a few billion of IPv6 ones? How do I add some extra IPv6 hops to a traceroute6, around pf(4) ...
4
votes
1answer
123 views

How do you do NAT port redirection with PF?

In Linux, you can do NAT port redirection with a command like this: iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8000 What is the equivalent with BSD's PF?
4
votes
1answer
30 views

PF's keep state on UDP packets = security issue?

During the last few days I've read a lot about PF as a nice alternative to iptables and a much more improved and secure way of filtering. Nevertheless I came across the following statement which I ...
4
votes
2answers
840 views

NAT and source IP filtering in PF, using OpenBSD >= 4.7

I just read a book about PF (The Book Of PF, No Starch), but there's one question not answered by it. If I have a gateway machine using two interfaces, $int_if and $ext_if, and I NAT the packages ...
3
votes
1answer
2k views

iptables/pf rule to only allow XY application/user?

I think there is no iptables/pf solution to only allow an XY application on e.g.: outbound tcp port 80, eth0. So if I have a userid: "500" then how could I block any other communications then the ...
3
votes
1answer
293 views

Setting up the firewall for amule on OpenBSD 4.7 gateway

I'm trying to properly setup the firewall on my gateway (OpenBSD 4.7) using pf to allow amule (on 10.0.0.104) to operate properly as discussed here: Now I know pf has changed a bit from OpenBSD 4.7 ...
3
votes
2answers
800 views

Letting NFS through a FreeBSD PF firewall

I'm trying to configure my firewall (PF) on FreeBSD to let NFS traffic through. I know that NFS uses both TCP and UDP to connect to the client along with a bunch of daemons that use random port ...
3
votes
1answer
289 views

Converting a line from a firewall on OpenBSD 4.9 to OpenBSD 4.7

What is the OpenBSD 4.7 equivalent of this line from OpenBSD 4.9 for use with pf? no nat on egress proto udp from 192.168.1.10 port 4672 to any
2
votes
1answer
253 views

How to configure OpenBSD pf to only allow inbound from given countries?

I have an OpenBSD 5.2 box what's running a webserver on port 80 and an SSHD server on port 2222. How can I configure OpenBSD's pf to only allow connections from given countries to port 80 and 2222?
2
votes
2answers
3k views

should I fix “No ALTQ support in kernel” to run the firewall?

I just messed with my pf.conf and ran pf and I got: Enabling pf. No ALTQ support in kernel Of course the fix is to re-compile the kernel, but that article is for freebsd 7. I'm on FreeBSD 9.1 I ...
2
votes
1answer
124 views

pf blocks all in/out traffic instead of just the one port I wanted to block

I need to block one incoming port with pf. I'm new to pf, and I can't figure out what I'm doing wrong here. Here is my entire rule file, made to block incoming port 22: set block-policy drop pass in ...
2
votes
1answer
77 views

Can pf be used to modify HTTP Headers and Contents?

I'm looking at options to replace my router with something that offers me more options for content filtering and also content modification. One of the things that I want to do is to modify HTTP ...
2
votes
1answer
9 views

“persist” attribute in OpenBSD Tables

According to OpenBSD's FAQs on "Tables" (http://www.openbsd.org/faq/pf/tables.html), without the persist attribute, the kernel will automatically remove the table when the last rule referencing ...
2
votes
0answers
37 views

pf out interface?

I'm trying to figure out how to allow all hosts in $dmz to reach any host when egressing $extif. I can't seem to find the equivalence of netfilters "-o $extif", and I'd like to avoid specifically ...
2
votes
0answers
138 views

FreeBSD pf firewall, new connections severly delayed when nating

I have a newly setup fbsd 9.1 with pf, which itself doesn't experience any slowness when for example downloading a debian iso from my local debian repo (ftp.se.debian.org). Any machine behind it, ...
1
vote
1answer
199 views

High performance routing with high churn ruleset. What approach is most likely to scale to C10K and beyond?

I've been asked to create a high throughput router using PC / server hardware. I'm modestly familiar with pf, iptables, and tc, but I've never had such high churn and so many rules. I hope you can ...
1
vote
1answer
191 views

Processing FreeBSD's PF logs with tcpdump/sed/awk

I'm running FreeBSD and have PF firewall set up and this is command i use to display daily number of firewall hits (blocked traffic) sudo tcpdump -n -e -tttt -r /var/log/pflog | grep $(date ...
1
vote
0answers
12 views

How do I add more IP addresses to my pf rules?

I wish to have all internet traffic to go through my VPN; when my VPN is disconnected, all internet traffic can not go out of my workstation/desktop (not server). I wish to switch VPN servers of one ...
1
vote
0answers
20 views

Why isn't my nat-to not applied to the pass out rule?

I've a strange problem concerning NAT on an OpenBSD-Box with pf. I've cut down my pf.conf to the following lines: extif = "pcn0" intif = "pcn1" block drop all #Allow all incoming traffic from intif ...
1
vote
0answers
33 views

I have a firewall bridge in pfSense and I want to log only the allowed packet

I have a bridge0 which has members em0 (wan) and vge0 (lan) I connect via ssh on vge0, when I tcpdump -i pflog0 I get the blocked packets from the bridge0, but when I tcpdump -i bridge0 I get both ...
1
vote
1answer
725 views

Routing a LAN through OpenVPN on OpenBSD 5.5

I'm configuring an OpenVPN gateway to allow a LAN access to the internet through the tunnel. The gateway is running OpenBSD 5.5-stable amd64 on the PC Engines APU platform. The LAN contains re1, re2, ...
1
vote
0answers
138 views

Perform Cisco's DNS Doctoring on FreeBSD

How to perform a change in the DNS response from a DNS server to be a different IP address than the DNS server actually answered for a given name? ...
0
votes
2answers
335 views

PF and types of NAT(Network Address Translation)

As you know, at least 3 types of NAT are used. Of course i need to two types of them.DNAT and SNAT. DNAT : hiding server behind NAT, SNAT : hiding your client behind NAT. Question: I read a quick ...
0
votes
1answer
502 views

port redirection with PF under OpenBSD

i need to do a setting a bit unusual. I have 3 machines with public Ips. I want to use one of them as a load balancer for the 2 others. My machine >> machine1 who redirect the connection to machine ...
0
votes
1answer
22 views

TLS and Packet Filtering

I want to set up a client wit BSD packet filtering that only allows outgoing 443 connections. Would this do the trick in my pf.conf? block out block in pass out on eth0 inet proto tcp from (eth0) ...