3

I am setting up an AWS VPC with an external/internal firewall to protect the hosts in the DMZ (for Internet->DMZ and DMZ->Internet traffic) and hosts on the local network (for DMZ->Local, Local->DMZ, and Local->Internet traffic). As OpenBSD now has Xen drivers, I created two OpenBSD 6.1 VMs and have them configured according to the diagram below. The external firewall, vegeta, can communicate with the Internet fine. However, the internal firewall, bulma cannot.

If I am on bulma and perform the following:

$ telnet 50.194.72.148 80

then I would expect to see packets on vegeta:xnf3, the default route for bulma, but I do not. I can ssh from bulma to vegeta fine so packets are going through. And, my pf firewall rules, even though they block everything by default, allow traffic and log all other failures. But, pf doesn't show any noteworthy failures. Am I just missing some AWS config to get this working?

Routing table on bulma:

bulma# route -n show -inet
Routing tables

Internet:
Destination        Gateway            Flags   Refs      Use   Mtu  Prio Iface
default            192.168.15.238     UGS        0      209     -     8 xnf0 
224/4              127.0.0.1          URS        0        0 32768     8 lo0  
127/8              127.0.0.1          UGRS       0        0 32768     8 lo0  
127.0.0.1          127.0.0.1          UHhl       1       22 32768     1 lo0  
192.168.15.0/28    192.168.15.14      UCn        2        0     -     4 xnf1 
192.168.15.1       0a:8f:0f:99:77:46  UHLc       0     5668     -     3 xnf1 
192.168.15.2       0a:8f:0f:99:77:46  UHLc       0        3     -     3 xnf1 
192.168.15.14      0a:cb:41:73:83:ca  UHLl       0     6052     -     1 xnf1 
192.168.15.15      192.168.15.14      UHb        0        0     -     1 xnf1 
192.168.15.224/28  192.168.15.228     UCn        2        0     -     4 xnf0 
192.168.15.225     0a:28:c7:f3:88:0c  UHLc       0     5671     -     3 xnf0 
192.168.15.228     0a:15:e5:12:a4:28  UHLl       0     5806     -     1 xnf0 
192.168.15.238     0a:c4:41:0e:06:74  UHLch      5      113     -     3 xnf0 
192.168.15.239     192.168.15.228     UHb        0        0     -     1 xnf0

/etc/pf.conf on bulma:

dmz_if = "xnf0"
int_if = "xnf1"

icmp_types = "{ echoreq, unreach }"

table <aws_nets> const { 192.168.15.0/24 }

set block-policy return
set skip on lo

block log all
block in quick inet6 all

# Allow ping and path MTU discovery
pass  in log inet proto icmp all icmp-type $icmp_types keep state
pass out log on $dmz_if inet proto { udp, icmp } all keep state

# Allow anything on the NAT interface
pass  in log on $dmz_if inet from <aws_nets> to any
pass out log on $dmz_if inet from $dmz_if:network to any

# Allow anything on the internal interface
pass out log on $int_if inet from $int_if:network to any

# Nat
match out log on $dmz_if inet from $int_if:network to any \
  nat-to ($dmz_if:0)
pass out log on $dmz_if from any to any

# Allow ssh
pass  in log on $dmz_if inet proto tcp from $dmz_if:network to \
  $dmz_if:0 port = ssh
pass out log on $dmz_if inet proto tcp from $dmz_if:network to \
  $dmz_if:network port = ssh

# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010

/etc/pf.conf on vegeta:

ext_if = "xnf0"
dmz_if = "xnf3"

icmp_types = "{ echoreq, unreach }"

table <aws_nets> const { 192.168.15.192/28, 192.168.15.208/28, \
                         192.168.15.224/28 }

set block-policy return
set skip on lo

block log all
block in quick inet6 all

# Allow ping and path MTU discovery
pass  in log inet proto icmp all icmp-type $icmp_types keep state
pass out log on $ext_if inet proto { udp, icmp } all keep state

# Allow anything on the NAT interface
pass  in log on $dmz_if inet from <aws_nets> to any

# Nat
match out log on $ext_if inet from $dmz_if:network to any \
  nat-to ($ext_if:0)
pass out log on $ext_if from any to any

# Allow ssh
pass  in log on $ext_if inet proto tcp from any to \
  any port = ssh
pass  in log on $dmz_if inet proto tcp from any to \
  any port = ssh
pass out log on $dmz_if inet proto tcp from $dmz_if:network to \
  $dmz_if:network port = ssh

# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010

enter image description here

enter image description here

enter image description here

  • OpenBSD does not have any eth interfaces, so your post is just a little confusing. Regardless, to help further, I’d like to see the output of `route -n show –inet' on bulma and your pf.conf for vegeta. – Bink Jul 12 '17 at 18:07
  • I was just using "eth3" to indicate "the fourth" interface. Sorry for the confusion. I will update the original posting as well as include your requested command output in it. – Albert Chin Jul 12 '17 at 18:52
  • Maybe the issue is the routing table? Seems like I need an entry for 0.0.0.0/0 to vegeta but I do not think that is possible. – Albert Chin Jul 12 '17 at 21:57
  • Sorry for the delay in getting back to you—sometimes life has a way of making some recreational activities impossible. I’ve reviewed the additional detail you provided and am uncertain why it’s not working. For the hell of it, what happens if you temporarily disable pf on bulma? (For what it’s worth, in general, last matching rule wins with pf so `pass out log on $dmz_if from any to any’ will apply and the previous “pass out on $dmz_if” rules will be skipped. – Bink Jul 13 '17 at 16:25
  • 1
    Turned out to be an AWS problem. campus.barracuda.com/product/nextgenfirewallf/article/NGF70/… and campus.barracuda.com/product/nextgenfirewallf/article/NGF70/… had the solution. In short, on AWS, I had to add a route in the 192.168.15.224/28 routing table so the default route went to the vegeta:xnf3 interface and then disable source/destination checking on the vegeta:xnf1 interface. – Albert Chin Jul 14 '17 at 20:35
0

Well it all depends on which interface you watch the packets. The pf runs on xnf0 and treats all pakets from nat as if they come from xnf3 alone. Try to run iftop monitor on xnf3 on vegeta a do your test again and see what happens.

# pkg_add -v iftop
# iftop -i xnf3

Also check your routes on bluma:

# netstat -rn -f inet

to make sure you got your default gw set to 192.168.15.238

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.