Tag Info

Hot answers tagged

9

I think you have mixed two different things: The OpenBSD packet filter facilities (sometimes called pf, and mostly controlled by pfctl). These are the basis of OpenBSD firewalling, the Linux equivalent is netfilter, mostly controlled by the iptables command. Comparable, but not compatible (and most say that OpenBSD is superior to Linux in this aspect). ...


5

Short answer: The Internet Doesn't Work That Way Longer answer: IP address blocks are not neatly demarcated per country. As far as IPv4 is concerned, the parent organization IANA allocated (past tense -- they're out of blocks) address blocks to the various NICs, which operate in very wide regions as you can see here. They then assign IP blocks to ISPs on a ...


4

This is commonly referred to as "port forwarding". Here is a snippet from the official documentation: Go to the Firewall menu, select NAT, then click on the Port Forward tab. Click on the + icon at the top or bottom of the screen. Choose the Interface for the port forward (likely WAN) and if needed, pick a virtual IP address from the External Address ...


3

I was running a FreeBSD based firewall without problems over many years with this particular issue. If you don't want to perform traffic shaping stuff, you don't need to fix, I would say. Or to say it in a different way: I wouldn't fix it.


3

here's the iptables command to allow for a certain uid through a certain port. iptables -A OUTPUT -p tcp -m tcp --dport 80 -m owner --uid-owner username -j ACCEPT from the man page [!] --uid-owner userid[-userid] Matches if the packet socket’s file structure (if it has one) is owned by the given user. You may also specify a ...


2

I ended up going with iptables under linux to accomplish this. For, IP forwarding needs to be turned on: echo net.ipv4.ip_forward=1 >> /etc/sysctl.conf And set the following rules: iptables -F -t nat # flush the NAT Table. iptables -t nat -P INPUT DROP # set the input chain on the NAT table to DROP by default. # This way any traffic not allowed ...


2

You want the first set. Regarding the OpenBSD documentation you can consult the man page for the most accurate info, if you don't have them installed you can get them from OpenBSDs site: http://www.openbsd.org/cgi-bin/man.cgi?query=pf.conf&apropos=0&sektion=0&manpath=OpenBSD+4.7&arch=amd64&format=html They keep all versions and there ...


1

The best way to do this is to define a table and create a rule to block the hosts, in pf.conf: table <badhosts> persist block on fxp0 from <badhosts> to any And then dynamically add/delete IP addresses from it: $ pfctl -t badhosts -T add 1.2.3.4 $ pfctl -t badhosts -T delete 1.2.3.4 Other 'table' commands include flush (remove all), replace ...


1

I got this information from the website and forgive me for my ill knowledge of OpenBSD, but here it goes. Take a look at this URL. According to it, it states to block an IP you would: echo '123.123.123.123' >> /etc/pf.blocked.ip.conf Then you would restart the firewall: pfctl -d pfctl -e -f /etc/pf.conf Or, to add without restarting the firewall ...


1

To PF or not to PF? I do not believe pf is the appropriate place to filter a high level element such as ga.js. Rather it operates a layer or two below that. Filtering ga.js would be better suited to something such as a proxy package such as Squid. excerpt from PF: Packet Filtering Packet filtering is the selective passing or blocking of data packets as ...


1

While I’ve never tried doing what you are doing, the best way to do this with OpenBSD will likely be with tables as you can easy add/remove IPs from tables.


1

DATE=$(date +%Y-%m-%d) HITS=$(sudo tcpdump -n -e -tttt -r /var/log/pflog | grep -c $DATE) echo "$DATE - $HITS" >> /home/pentago/www/pf.txt


1

It's not just something you can do with pf. The example you cite mentions using VRFs. On OpenBSD you need to create multiple routing domains (rdomains) using the rtable command. You'll need to build a series of routing tables and virtual interfaces so that each hop jumps to a new table. In order to do the Star Wars crawl you'll also need to either edit your ...


1

You can do it like this with Packet Filter : pass in on em0 proto tcp from any to any port 80 rdr-to 192.168.1.20 port 8000 Change em0 with your network interface, and change the IP address to suit your needs. Read more : http://www.openbsd.org/faq/pf/rdr.html#filter


1

I've been using NAT for a long time and this the first time I've seen the terms DNAT and SNAT. I had to go look at Wikipedia. To help you, pay attention to Wikipedia when it says "This use of DNAT is also called port forwarding". I've only ever heard it called port forwarding. The keyword you'll want on your rules is "rdr-to". Wikipedia points out that ...


1

I don't think PF makes a "clear" distinction between DNAT and SNAT. Some of these terms seem to be pretty ambiguous judging from the Wikipedia page. But if you look here, I think you will find all sorts of options to build the rules that match the direction of the traffic you want.


1

No, you absolutely do NOT need ALTQ to re-route traffic to and from your freebsd jails. I use pf to map traffic on external IPs to the static IPs that my jails run on. The following entries direct traffic to and from the internet to the jails for my mail server: ext_if="bce1" lo_toaster = "127.0.0.6" toaster = "208.75.177.101" nat on $ext_if from ...


1

I'm having a hard time understanding exactly what you want to do here... a network diagram and more detail would be extremely helpful. To redirect traffic using pf you need to use the rdr-to directive. Here's an example where I'm redirecting traffic through my firewall to my webserver on the other side: # redirect external web traffic to darkstat pass in ...


1

NFS is an old evil from the dark ages of Unix. ;-) Your question relates to every firewall setup for NFS (v2 and v3 - not sure about v4). It uses RPC and the portmapper daemon. The trick is to force the portmapper of the NFS-server to a specific port or port-range.


1

HAProxy has been compiled on a bunch of *nix platforms, including the BSDs and Solaris (and of course Linux). If your load balancer isn't running Linux, it's a very convenient and configurable piece of software. It knows about HTTP but can also balance any TCP service it knows nothing about. It can check servers and will remove from service any that aren't ...


1

I'm only familiar with a pure Linux combination of heartbeat and ldirector (both part of the linux virtual server project to IP tunnel traffic from a pair of front-ends to N back-ends, and to share/swap a front-end IP between two front-ends when one dies. It worked very well in the environment I used, but I'm not sure whether it is vulnerable to split-brain ...


1

Assuming your previous rules were something like this: nat on egress from 192.168.1.0/24 -> (egress) no nat on egress proto udp from 192.168.1.10 port 4672 to any an example of doing this with the new rules would be match out on egress proto udp from 192.168.1.10 port 4672 tag NONAT match out on egress from 192.168.1.0/24 !tagged NONAT nat-to (egress) ...



Only top voted, non community-wiki answers of a minimum length are eligible