pf (Packet Filter) is the TCP/IP packet filtering firewall subsystem on BSD systems.

learn more… | top users | synonyms

10
votes
3answers
8k views

How to block abusive IP addresses with pf in OpenBSD?

We can see from the nginx logs that there is an IP address doing nasty things. How can we block it with a pf command and then later permanently with the /etc/pf.log? How can we block a x.x.x.x/24 ...
7
votes
6answers
854 views

Can I use Unix to load-balance two Linux servers?

I'm trying to work out a solution in my head where two backend linux-servers run HTTP, SMTP, XMPP mirrored and should load balance connections between them. My current solution is an OpenBSD box ...
6
votes
2answers
2k views

NAT and source IP filtering in PF, using OpenBSD >= 4.7

I just read a book about PF (The Book Of PF, No Starch), but there's one question not answered by it. If I have a gateway machine using two interfaces, $int_if and $ext_if, and I NAT the packages ...
4
votes
1answer
3k views

Is berkeley packet filter ported to linux?

I am doing some research to figure out what distro's of linux contain kernel packet filtering and are compatible with BPF. http://kernelnewbies.org/Linux_3.0 http://lwn.net/Articles/437981/ These ...
4
votes
1answer
7k views

How to configure pfsense to NAT servers?

How can I configure pfsense so it will NAT servers so they can be accessed outside of the company? I tried to play around with the NAT settings, but didn't get anywhere. I want to be able to access ...
4
votes
1answer
531 views

Block outgoing connections to certain IP using PF

Can someone give me a hint on how to setup a basic deny rule whenever any TCP request is sent to a specific IP address? I am using the PF packet filter. Any help?
4
votes
3answers
249 views

OpenBSD's pf: disable network access for a given user, except for ssh.

If we are using the default firewall for OpenBSD, how can we modify it to disable all the network access for a normal user except for one thing: we want to ssh to the user from random hosts! So ...
4
votes
1answer
301 views

Inserting a nat solution into a network while it's not the gateway

I have tried this a few different ways. Currently trying with pf on freebsd 8.2 I am trying to insert a nat solution into an existing network that will redirect traffic from an outside ip address to ...
4
votes
1answer
138 views

putting extra hops into traceroute6 on OpenBSD

I'm running OpenBSD, or maybe FreeBSD. I don't have lots of IPv4 addresses to waste, but who doesn't have a few billion of IPv6 ones? How do I add some extra IPv6 hops to a traceroute6, around pf(4) ...
4
votes
1answer
420 views

How do you do NAT port redirection with PF?

In Linux, you can do NAT port redirection with a command like this: iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8000 What is the equivalent with BSD's PF?
4
votes
0answers
75 views

Accessing ports on public IP from within a FreeBSD jail

In a FreeBSD 10 setup, I have a jail running the publicly accessible nginx web server and another jail for the Java backend server based on Jetty. Each jail has its own internal IP address 127.0.1.x ...
4
votes
1answer
113 views

PF's keep state on UDP packets = security issue?

During the last few days I've read a lot about PF as a nice alternative to iptables and a much more improved and secure way of filtering. Nevertheless I came across the following statement which I ...
3
votes
2answers
7k views

should I fix “No ALTQ support in kernel” to run the firewall?

I just messed with my pf.conf and ran pf and I got: Enabling pf. No ALTQ support in kernel Of course the fix is to re-compile the kernel, but that article is for freebsd 7. I'm on FreeBSD 9.1 I ...
3
votes
1answer
3k views

iptables/pf rule to only allow XY application/user?

I think there is no iptables/pf solution to only allow an XY application on e.g.: outbound tcp port 80, eth0. So if I have a userid: "500" then how could I block any other communications then the ...
3
votes
1answer
22 views

Cannot ping OUT of a Mac OS X server

I have just inherited a Mac OS X server that is using pf. The problem I am trying to solve is why I can't ping OUT of the server. I can ping to the machine no worries, but just get timeouts on pinging ...
3
votes
1answer
329 views

Setting up the firewall for amule on OpenBSD 4.7 gateway

I'm trying to properly setup the firewall on my gateway (OpenBSD 4.7) using pf to allow amule (on 10.0.0.104) to operate properly as discussed here: Now I know pf has changed a bit from OpenBSD 4.7 ...
3
votes
1answer
74 views

Reject packets in pf after a connection consumed a certain amount of traffic

In pf you can limit the bandwidth that is consumed (by for example ssh) using queues. I am hosting a UDP Service (Discard Protocol) which can easily eat up all my traffic when a client transfers ...
3
votes
1answer
370 views

OpenBSD pf NAT rules based on DHCP/DNS

I have a Proxmox installed and an OpenBSD VM in front of all the others to play the role of NAT, firewall, DNS and DHCP. I have a fully functional DNS and DHCP. My DHCP is correctly updating my DNS ...
3
votes
2answers
1k views

Letting NFS through a FreeBSD PF firewall

I'm trying to configure my firewall (PF) on FreeBSD to let NFS traffic through. I know that NFS uses both TCP and UDP to connect to the client along with a bunch of daemons that use random port ...
3
votes
1answer
300 views

Converting a line from a firewall on OpenBSD 4.9 to OpenBSD 4.7

What is the OpenBSD 4.7 equivalent of this line from OpenBSD 4.9 for use with pf? no nat on egress proto udp from 192.168.1.10 port 4672 to any
2
votes
1answer
307 views

How to configure OpenBSD pf to only allow inbound from given countries?

I have an OpenBSD 5.2 box what's running a webserver on port 80 and an SSHD server on port 2222. How can I configure OpenBSD's pf to only allow connections from given countries to port 80 and 2222?
2
votes
1answer
75 views

on FreeBSD, how do I open a port on WAN but not on LAN?

I have one FreeBSD machine that I use as a playbox/server/torrentbox. It's part of my LAN. Here is the semantics (altered from an example on the OpenBSD website): [ desktop ] [ laptop ] | ...
2
votes
1answer
495 views

macos - local port redirection using pfctl and syntax errors

I am running MacOS(really BSD), and I want to redirect certain traffic over an ssh tunnel using a a local forward. Seems easy enough, but I am repeatedly blocked by the ambiguous "/etc/pf.conf:29: ...
2
votes
1answer
61 views

“persist” attribute in OpenBSD Tables

According to OpenBSD's FAQs on "Tables" (http://www.openbsd.org/faq/pf/tables.html), without the persist attribute, the kernel will automatically remove the table when the last rule referencing ...
2
votes
2answers
76 views

How do I add more IP addresses to my pf rules?

I wish to have all internet traffic to go through my VPN; when my VPN is disconnected, all internet traffic can not go out of my workstation/desktop (not server). I wish to switch VPN servers of one ...
2
votes
1answer
1k views

pf blocks all in/out traffic instead of just the one port I wanted to block

I need to block one incoming port with pf. I'm new to pf, and I can't figure out what I'm doing wrong here. Here is my entire rule file, made to block incoming port 22: set block-policy drop pass in ...
2
votes
1answer
195 views

Can pf be used to modify HTTP Headers and Contents?

I'm looking at options to replace my router with something that offers me more options for content filtering and also content modification. One of the things that I want to do is to modify HTTP ...
2
votes
0answers
32 views

pfctl - How to forward ip address in Mac OS Yosemite

How to forward all traffic to an external site 172.16.19.211:5001 to 127.0.0.1:5000 ? These docs have details about port forwarding but still ip forwarding is unclear. http://www.openbsd.org/faq/pf/...
2
votes
0answers
116 views

Why isn't my nat-to not applied to the pass out rule?

I've a strange problem concerning NAT on an OpenBSD-Box with pf. I've cut down my pf.conf to the following lines: extif = "pcn0" intif = "pcn1" block drop all #Allow all incoming traffic from intif ...
2
votes
1answer
3k views

Routing a LAN through OpenVPN on OpenBSD 5.5

I'm configuring an OpenVPN gateway to allow a LAN access to the internet through the tunnel. The gateway is running OpenBSD 5.5-stable amd64 on the PC Engines APU platform. The LAN contains re1, re2, ...
2
votes
0answers
50 views

pf out interface?

I'm trying to figure out how to allow all hosts in $dmz to reach any host when egressing $extif. I can't seem to find the equivalence of netfilters "-o $extif", and I'd like to avoid specifically ...
2
votes
0answers
197 views

FreeBSD pf firewall, new connections severly delayed when nating

I have a newly setup fbsd 9.1 with pf, which itself doesn't experience any slowness when for example downloading a debian iso from my local debian repo (ftp.se.debian.org). Any machine behind it, ...
1
vote
2answers
32 views

Applying NAT to traffic from GRE tunnel in OpenBSD PF

All I have a Cisco 877 router and a Linode VPS running OpenBSD 5.9 with a GRE tunnel running in between, which works great and I can ping from either side. I have set up a static route in the Cisco ...
1
vote
1answer
216 views

High performance routing with high churn ruleset. What approach is most likely to scale to C10K and beyond?

I've been asked to create a high throughput router using PC / server hardware. I'm modestly familiar with pf, iptables, and tc, but I've never had such high churn and so many rules. I hope you can ...
1
vote
1answer
670 views

Processing FreeBSD's PF logs with tcpdump/sed/awk

I'm running FreeBSD and have PF firewall set up and this is command i use to display daily number of firewall hits (blocked traffic) sudo tcpdump -n -e -tttt -r /var/log/pflog | grep $(date +%Y-%m-%d)...
1
vote
0answers
33 views

Is it possible? Three OpenBSD 6.0-current firewall bridges with only one OpenBSD Server?

Is it possible to configure several firewall bridges with one OpenBSD server which has 6 nic's. In this case 3 OpenBSD firewall bridges from each other completely independent? cat /etc/sysctl.conf ...
1
vote
1answer
96 views

Configuring OpenBSD's PF as a router

I am running OpenBSD 4.4, I copied the template from https://markshroyer.com/guides/router/ch07.html for /etc/pf.conf and edited it to match my network. When I start it I get syntax errors on only ...
1
vote
0answers
349 views

Can not divert packet to pf when configure transparent squid 3.4.13 on OpenBSD 5.7

I am trying to build transparent proxy with squid on OpenBSD 5.7 with pf firewall. I compile squid from sources with options: $ squid -v Squid Cache: Version **3.4.13** configure options: --...
1
vote
1answer
24 views

How to only allow a group for network access?

Using OpenBSD's pf. Question: How can we modify the firewall of OpenBSD to allow ONLY a given group for network access? If somebody isn't in that group, it shouldn't have layer 3 or layer 2 network ...
1
vote
0answers
273 views

I have a firewall bridge in pfSense and I want to log only the allowed packet

I have a bridge0 which has members em0 (wan) and vge0 (lan) I connect via ssh on vge0, when I tcpdump -i pflog0 I get the blocked packets from the bridge0, but when I tcpdump -i bridge0 I get both ...
1
vote
0answers
183 views

Perform Cisco's DNS Doctoring on FreeBSD

How to perform a change in the DNS response from a DNS server to be a different IP address than the DNS server actually answered for a given name? http://www.cisco.com/en/US/products/hw/vpndevc/...
0
votes
1answer
173 views

ip_conntrack and FreeBSD

We can figure out number of connections in GNU\Linux with ip_conntrack module, And I can print current connections and maximum of connections with: root@debian:/home/mohsen/test/shell# sysctl net....
0
votes
2answers
593 views

PF and types of NAT(Network Address Translation)

As you know, at least 3 types of NAT are used. Of course i need to two types of them.DNAT and SNAT. DNAT : hiding server behind NAT, SNAT : hiding your client behind NAT. Question: I read a quick ...
0
votes
1answer
879 views

port redirection with PF under OpenBSD

i need to do a setting a bit unusual. I have 3 machines with public Ips. I want to use one of them as a load balancer for the 2 others. My machine >> machine1 who redirect the connection to machine ...
0
votes
0answers
12 views

pcfl - Allow ssh for an specific IP

I'm working with pfctl on Mac OS X. Im trying to make a policy/anchor what blocks SSH for ALL ips, minus specific ip. I try this: pass in on fxp0 proto tcp from any to any port < 22 flags S/SA ...
0
votes
2answers
19 views

Messed up my mac firewall configuration (pf.conf) and ended up with 100% packet loss

I was trying to do wifi throttling for my new app development (new to this) and was trying to do it using iceFloor application. I'm not 100% sure if this is a problem, but i need to confirm if i ...
0
votes
2answers
49 views

Block IP if it connects to port 22

How can I effectively (so do it fast when talking about firewall level and can do it with many-many IP's) block an IP address for a given time, ex.: a month if it tried to contact port 22 TCP in any ...
0
votes
1answer
26 views

set up pfctl to forbid local applications accessing a specific hostname

I am an OSX user, and I want to ban some hostnames, with which some local applications may do nasty things. pfctl is the default firewall on OSX 10.11 El captain. So, how to block the specific ...
0
votes
0answers
104 views

Configure FreeBSD pf firewall (non GUI) for beginner

I am running Mac OS X 10.10, but my research has led me to the understanding that the particular flavor of pf was ported from FreeBSD. I have tried the popular GUI software (IceFloor) but it is a bit ...
0
votes
1answer
66 views

TLS and Packet Filtering

I want to set up a client wit BSD packet filtering that only allows outgoing 443 connections. Would this do the trick in my pf.conf? block out block in pass out on eth0 inet proto tcp from (eth0) ...