3

I have a Proxmox installed and an OpenBSD VM in front of all the others to play the role of NAT, firewall, DNS and DHCP.

I have a fully functional DNS and DHCP. My DHCP is correctly updating my DNS records. My NAT is also working well since my other VMs can reach the internet.

Now I would like to have a working firewall and incoming NAT rules.

For instance I have a VM named nginx, which can be contacted though nginx.local.lan.

In short terms, this is what I want to do:

  • Redirect 80 and 443 ports to my ngnix.local.lan.
  • Block everything that comes from the WAN interface (em0) except what is natted (80 and 443 to nginx) and SSH.
  • But I also want to allow everything that comes from the LAN interface (em1).

Here is my current pf.conf file:

 set skip on lo
 block return    # block stateless traffic
 pass            # establish keep-state

 # Define interfaces
 ext_if=em0
 int_if=em1

 # Allow SSH connections
 pass in on $ext_if inet proto tcp from any to ($ext_if) port 22

 # Allow VMs to get out of the network
 pass out on $ext_if inet from $int_if:network to any nat-to $ext_if
1

I finally found a way to do everything I said before. I'm going to explaining it:

In /etc/pf.conf:

Denying all incoming trafic

(Except the LAN interface)

 block in all
 pass in quick on $int_if

The first line block eveything while the second one allow anything from the LAN interface. If you wonder what the quick keyword is, read this.

How can you be sure it's working? Just do a pfctl -sr, it should output something like:

 block drop in all
 pass in quick on em1 all flags S/SA

Redirecting the HTTP(S) traffic to a VM

As said before, I already configured a working DNS, DHCP, DDNS setup. Which means that if I have an nginx VM that's asking for a DHCP lease, it'll automatically associate the nginx.local.lan entry of the domain to the leased IP.

Knowing that, I tried to make it elegent in the config file using macro :

nginx_vm_map=80 443
pass in quick on $ext_if proto tcp from any to any port {$nginx_vm_map} rdr-to nginx.local.lan

The first line define the ports I want to redirect to my VM, then I use this macro $nginx_vm_map inside the natting rule to make it easily changeable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.