Questions tagged [pf]
pf (Packet Filter) is the TCP/IP packet filtering firewall subsystem on BSD systems.
86
questions
0
votes
0
answers
10
views
Can I prevent access to a port to a specific process? (MacOS)
I have a handful of kafka brokers running locally on my laptop and I'd like to "cut the network" between 2 brokers to test a few things. Is it possible? I'm on a Mac.
I see that iptables was ...
- 873
0
votes
1
answer
255
views
FreeBSD: PF / pf.conf forwarding rule between interfaces
I would like to set up a simple forward rule (not port forward!) on FreeBSD 12.3 that filters based on received-on interface and going-out-on interface. IP networks should not be part of the rule as ...
- 13k
4
votes
1
answer
365
views
Should changing firewall settings to block all interrupt ongoing ssh session
Suppose I am logged into a server via ssh. While in the session, I change the firewall config to block all traffic.
When I tried this previously with FreeBSD and pf, the current connection was broken. ...
- 424
2
votes
1
answer
205
views
Isssues forwarding port / Nat on openbsd
I am unable to make port 80 available on the WAN and I am not sure why.
My setup is just my home network acting as the wan and my ‘lab’ as the lan. Wan 192.168.0.0/24 and lan is 192.168.5.0/24. Router ...
- 23
3
votes
0
answers
233
views
EdgeRouter Lite OpenBSD traffic routing limits
When routing traffic between (virtual) interfaces on Ubiquiti EdgeRouter Lite it is hitting some sort of limit. I'd like to get some help to determine what sort of limit is that and how it can be ...
- 53
-1
votes
1
answer
371
views
Bridging Ethernet Interface on OpenBSD and Other Problems
I am currently setting up an OpenBSD firewall, router, and dns server. I've been following various guides online with the bulk of my configuration coming from the OpenBSD site and the pf configuration ...
- 41
0
votes
1
answer
68
views
Filtering the ICMP packets on Solaris using IP-addresses from the table
I'm currently working with Packet Filter on Solaris machine, trying to create a rule that would filter out all ICMP packets of particular type and code. Here is my rule line:
block out quick proto ...
- 109
0
votes
1
answer
349
views
macos monterey: PF load anchor syntax error
I am trying to make a NAT interface to connect tap0 to the internet for QEMU. So far I've made a bridge and connected tap0 to it:
sudo ifconfig bridge1 create
sudo ifconfig bridge1 addm tap0
sudo ...
1
vote
2
answers
446
views
Openbsd wireguard to wireguard
I build a server (vps) which play the role of my gateway. My whole personal network is connected behind through wireguard. Every think works well, I follow more or less https://openbsdrouterguide.net ...
- 71
0
votes
0
answers
328
views
Can't ping to OpenBSD router's globally routable IPv6 addresses
My router's IP address layout is as follows, anonymized to protect my network's privacy:
11.22.33.44 IPv4 WAN address
192.168.42.1 IPv4 LAN ...
- 113
1
vote
1
answer
47
views
PF states table give preoccupant results
I freshly install openBSD on a VPS. It is my first time. I did nothing but check the firewall setup, say pf. I ran pfctl -sa and it show
all tcp IP0:22 <- IP1:rnd ESTABLISHED:ESTABLISHED
all tcp ...
- 71
0
votes
1
answer
41
views
pf - time of day filter
I'm using pf: https://www.openbsd.org/faq/pf/config.html, as a firewall on my router. I would like to implement a time of day filter in pf if that is possible so that I wouldn't need to script it ...
- 1,184
0
votes
1
answer
146
views
Modifying firewall rules with pfctl on NetBSD 4
I'm wanting to modify some firewall/NAT rules on a device (Apple Airport) running NetBSD 4.0. I'm not that familiar with BSD and pf, so want to check the right approach. I can change the pf.conf file (...
- 101
0
votes
1
answer
777
views
pf: difference between 'modulate state' and 'keep state'
What's the difference between "modulate state" and "keep state" in the packet filter (pf) firewall?
I'm using MacOS X Catalina 10.15.5. I have no idea how to check what version of ...
- 149
1
vote
1
answer
230
views
Howto block all SSH connection attempts coming in from $extif
What is the PF notation to block on $ext_if all incoming SSH connection attempts?
$ext_if is the interface pointing toward the internet. Somthing like:
block quick in on $ext_if proto tcp to port 22
...
- 133
1
vote
1
answer
600
views
Convert iptables rules to pf
I would like to ask you how to change following iptable rule:
iptables -t nat PREROUTING --source x.x.x.x/24 -p tcp -m tcp --dport 443 -j DNAT --to x.x.x.x:8080
to pf. I am trying to capture
- 11
0
votes
1
answer
264
views
How to write a PF firewall rule that filters communications between processes on the same host?
How to write a PF firewall rule that filters communications between processes on the same host?
From reading the man pages, I understand that packets must physically traverse the given interface for ...
- 3,779
0
votes
1
answer
872
views
How does route-to work in the BSD pf firewall?
I've recently learned about the route-to functionality in the pf firewall, and I wonder how it works. Is it similar to the "policy-based routing" system in linux? How does route-to allow the ...
- 103
7
votes
1
answer
4k
views
How to setup simple port forwarding on macOS with pf? "Rules must be in order: options, normalization, queueing, translation, filtering"
I am trying to pass traffic from Mac A port 5800 to Mac B on port 5900 using pf.
This is the intended path of travel:
Client to port 5800 → Router (Yes, port forwarding is setup here) → Mac with PF →...
- 201
2
votes
1
answer
562
views
blacklistd not blocking addresses
I've enabled the PF(4) firewall and blacklistd(8). Although IP addresses are being added to to blacklist, I can still see multiple failed attempts from a single IP address. Yet when I test it myself, ...
- 220
1
vote
1
answer
981
views
pf not stopping bruteforce attempts
I am setting up an SFTP server for me and my friends and I am trying to stop brute force attempts.
I have read many articles on how to get pf to stop brute force attacks and am not having any luck.
...
- 13
0
votes
1
answer
169
views
macOS pf asymmetric routing through VLANs
I have a VLAN interface vlan0 that has a tag of 444 that has an IP of 172.16.16.16
The VLAN goes through the physical en0 interface.
I have another interface mine0 that's local just to the computer....
- 143
1
vote
1
answer
228
views
How to set up a firewall for testing web applications in a virtual machine? [closed]
I'd like to locally test my web application's behavior under different firewall circumstances.
We have an application that makes requests from the browser to different ports depending upon certain ...
- 945
6
votes
1
answer
1k
views
NAT outbound IPSEC packets using pf on FreeBSD 11 and StrongSwan x FortiGATE
I've been working for more than a week trying to get outbound packets nat'ed to fit a Security Association.
This is my (example) scenario:
LAN: 1.1.1.0/24
FreeBSD interface: xn0 (Amazon EC2 ...
- 101
1
vote
1
answer
627
views
PF Rules to Block All But Accesses to VPN and LAN
The rule set to block all outgoing connections except for VPN access could be like this:
block drop all
pass on lo0
pass on utun0
pass out proto udp from any to xxx.yyy.zzz.ttt port pppp
This works ...
- 117
0
votes
2
answers
595
views
bsd packet filter on Solaris, why ping not allowed?
I have two interfaces one is net0 with 192.168.0.30 ip
the other is vnic0 with 10.2.0.1 ip
This is my pf.conf,solaris is 11.4
ext_if="net0"
int_if="vnic0"
localnet="192.168.0.0/24"
internalnet="10.2....
- 11.7k
3
votes
2
answers
1k
views
Is there a difference between re0 and wlan0?
I am new to FreeBSD and trying to set up a firewall with pf on my laptop. The machine is connected to the internet via wifi.
On writing rule sets in /etc/pf.conf, some tutorials say to spell out the ...
- 173
1
vote
1
answer
417
views
Graph gateway in/out traffic per client
tl;dr: Suppose I have a list of LAN clients (ip/macaddress/name); how would I best go about graphing the traffic going in/out of my OpenBSD 6.1 gateway?
In my network everything going in/out of it ...
- 217
1
vote
3
answers
648
views
Totally open FreeBSD router in VirtualBox
TL;DR - I'd like to set up a FreeBSD VM with one network card on my home LAN (192.168.1.0/24) and one on a private-internal-to-virtualbox network (10.9.9.0/24) and pass any and all traffic back and ...
- 4,830
3
votes
1
answer
1k
views
Block all traffic out except one port with pfctl for macOS
As stated in the question, I need to block all traffic out to internet except for one port on MAC OS X 10.8.x.
I just need the commands to run from a shell or edit any conf file?
- 203
1
vote
1
answer
455
views
Set $ext_if, $int_if, $localnet in PF
I am currently trying to get familiar with the basics of PF on FreeBSD.
I am trying to setup the most basic example from the PF chapter in the FreeBSD handbook, the simple bruteforce rules:
block ...
1
vote
0
answers
83
views
Can a block rule on PF add the src ip to a table
So on iptables I can make deny rules act as honey pots by adding ip's that hit the rules to a list that another rule is used to block all traffic from.
I am trying to achieve the same thing on PF, ...
- 11
1
vote
0
answers
905
views
FreeBSD load balancer implementation
I have a program, which cannot be used in multiprocess\multithread mode, so it eat one CPU core, others cores are free, but RAM and network bandwidth usage near to 10% from max.
The server for the ...
- 61
0
votes
1
answer
808
views
pf: Forwarding all packets on port 80 from any interface to SOCKS proxy
I'm trying to forward any packets on port 80 from any interface to my SOCKS proxy (Server). I'm not sure if I have it set up correctly but I can't get it to forward the packets.
I create a SOCKS ...
- 370
1
vote
1
answer
2k
views
Slow VPN speed strongswan on FreeBSD
I put up a VPN server with strongswan 5.4.0 on FreeBSD 11.0-RELEASE-p1 on a RaspberryPi 2. So far it works fine, but the speed is varying and also much slower than on Raspian which I used before.
...
- 111
3
votes
1
answer
1k
views
Freebsd: pf firewall doesn't work on restart
I'm running FreeBSD 10.3 p4 and observed some strange behavior
When restarting the machine pf starts due to /etc/rc.conf entry
# JAILS
cloned_interfaces="${cloned_interfaces} lo1"
gateway_enable="...
- 133
1
vote
0
answers
642
views
Is it possible? Three OpenBSD 6.0-current firewall bridges with only one OpenBSD Server?
Is it possible to configure several firewall bridges with one OpenBSD server which has 6 nic's. In this case 3 OpenBSD firewall bridges from each other completely independent?
cat /etc/sysctl.conf
...
- 229
1
vote
2
answers
1k
views
Applying NAT to traffic from GRE tunnel in OpenBSD PF
All
I have a Cisco 877 router and a Linode VPS running OpenBSD 5.9 with a GRE tunnel running in between, which works great and I can ping from either side. I have set up a static route in the Cisco ...
- 273
2
votes
1
answer
213
views
Cannot ping OUT of a Mac OS X server
I have just inherited a Mac OS X server that is using pf. The problem I am trying to solve is why I can't ping OUT of the server. I can ping to the machine no worries, but just get timeouts on pinging ...
user171069
0
votes
2
answers
97
views
Messed up my mac firewall configuration (pf.conf) and ended up with 100% packet loss
I was trying to do wifi throttling for my new app development (new to this) and was trying to do it using iceFloor application. I'm not 100% sure if this is a problem, but i need to confirm if i ...
2
votes
0
answers
253
views
pfctl - How to forward ip address in Mac OS Yosemite
How to forward all traffic to an external site 172.16.19.211:5001 to 127.0.0.1:5000 ?
These docs have details about port forwarding but still ip forwarding is unclear.
http://www.openbsd.org/faq/pf/...
- 173
5
votes
2
answers
2k
views
Accessing ports on public IP from within a FreeBSD jail
In a FreeBSD 10 setup, I have a jail running the publicly accessible nginx web server and another jail for the Java backend server based on Jetty. Each jail has its own internal IP address 127.0.1.x ...
0
votes
2
answers
2k
views
Block IP if it connects to port 22
How can I effectively (so do it fast when talking about firewall level and can do it with many-many IP's) block an IP address for a given time, ex.: a month if it tried to contact port 22 TCP in any ...
- 1
0
votes
1
answer
961
views
Permanently start the OpenBSD pf Firewall on OS X
I use Mac OS X El Capitan 10.11.3 at the desktop OS. As everyone knows, is Apple's Mac OS X built on FreeBSD! I use normal only Debian/GNU/Linux on desktop and OpenBSD on Server and Firewall:
So my ...
- 229
0
votes
1
answer
275
views
set up pfctl to forbid local applications accessing a specific hostname
I am an OSX user, and I want to ban some hostnames, with which some local applications may do nasty things.
pfctl is the default firewall on OSX 10.11 El captain. So, how to block the specific ...
- 223
1
vote
1
answer
370
views
Configuring OpenBSD's PF as a router
I am running OpenBSD 4.4, I copied the template from https://markshroyer.com/guides/router/ch07.html for /etc/pf.conf and edited it to match my network.
When I start it I get syntax errors on only ...
- 250
2
votes
1
answer
246
views
on FreeBSD, how do I open a port on WAN but not on LAN?
I have one FreeBSD machine that I use as a playbox/server/torrentbox. It's part of my LAN. Here is the semantics (altered from an example on the OpenBSD website):
[ desktop ] [ laptop ]
| ...
- 35
1
vote
0
answers
1k
views
Can not divert packet to pf when configure transparent squid 3.4.13 on OpenBSD 5.7
I am trying to build transparent proxy with squid on OpenBSD 5.7 with pf firewall.
I compile squid from sources with options:
$ squid -v
Squid Cache: Version **3.4.13**
configure options:
--prefix=...
- 11
5
votes
1
answer
6k
views
Block outgoing connections to certain IP using PF
Can someone give me a hint on how to setup a basic deny rule whenever any TCP request is sent to a specific IP address? I am using the PF packet filter. Any help?
- 211
0
votes
1
answer
780
views
ip_conntrack and FreeBSD
We can figure out number of connections in GNU\Linux with ip_conntrack module, And I can print current connections and maximum of connections with:
root@debian:/home/mohsen/test/shell# sysctl net....
- 10.5k