Questions tagged [pf]

pf (Packet Filter) is the TCP/IP packet filtering firewall subsystem on BSD systems.

Filter by
Sorted by
Tagged with
1
vote
1answer
1k views

Slow VPN speed strongswan on FreeBSD

I put up a VPN server with strongswan 5.4.0 on FreeBSD 11.0-RELEASE-p1 on a RaspberryPi 2. So far it works fine, but the speed is varying and also much slower than on Raspian which I used before. ...
0
votes
0answers
31 views

How does route-to work in the BSD pf firewall?

I've recently learned about the route-to functionality in the pf firewall, and I wonder how it works. Is it similar to the "policy-based routing" system in linux? How does route-to allow the ...
3
votes
1answer
1k views

OpenBSD pf NAT rules based on DHCP/DNS

I have a Proxmox installed and an OpenBSD VM in front of all the others to play the role of NAT, firewall, DNS and DHCP. I have a fully functional DNS and DHCP. My DHCP is correctly updating my DNS ...
0
votes
0answers
200 views

Configure FreeBSD pf firewall (non GUI)

I am running Mac OS X 10.10, but my research has led me to the understanding that the particular flavor of pf was ported from FreeBSD. I have tried the popular GUI software (IceFloor) but it is a bit ...
0
votes
1answer
402 views

pf: Forwarding all packets on port 80 from any interface to SOCKS proxy

I'm trying to forward any packets on port 80 from any interface to my SOCKS proxy (Server). I'm not sure if I have it set up correctly but I can't get it to forward the packets. I create a SOCKS ...
4
votes
1answer
248 views

How to setup simple port forwarding on macOS with pf? “Rules must be in order: options, normalization, queueing, translation, filtering”

I am trying to pass traffic from Mac A port 5800 to Mac B on port 5900 using pf. This is the intended path of travel: Client to port 5800 → Router (Yes, port forwarding is setup here) → Mac with PF →...
3
votes
1answer
290 views

Block all traffic out except one port with pfctl for macOS

As stated in the question, I need to block all traffic out to internet except for one port on MAC OS X 10.8.x. I just need the commands to run from a shell or edit any conf file?
0
votes
1answer
83 views

blacklistd not blocking addresses

I've enabled the PF(4) firewall and blacklistd(8). Although IP addresses are being added to to blacklist, I can still see multiple failed attempts from a single IP address. Yet when I test it myself, ...
0
votes
2answers
1k views

Block IP if it connects to port 22

How can I effectively (so do it fast when talking about firewall level and can do it with many-many IP's) block an IP address for a given time, ex.: a month if it tried to contact port 22 TCP in any ...
0
votes
1answer
255 views

pf not stopping bruteforce attempts

I am setting up an SFTP server for me and my friends and I am trying to stop brute force attempts. I have read many articles on how to get pf to stop brute force attacks and am not having any luck. ...
0
votes
1answer
62 views

macOS pf asymmetric routing through VLANs

I have a VLAN interface vlan0 that has a tag of 444 that has an IP of 172.16.16.16 The VLAN goes through the physical en0 interface. I have another interface mine0 that's local just to the computer....
3
votes
1answer
232 views

FreeBSD pf firewall, new connections severly delayed when nating

I have a newly setup fbsd 9.1 with pf, which itself doesn't experience any slowness when for example downloading a debian iso from my local debian repo (ftp.se.debian.org). Any machine behind it, ...
5
votes
2answers
813 views

Accessing ports on public IP from within a FreeBSD jail

In a FreeBSD 10 setup, I have a jail running the publicly accessible nginx web server and another jail for the Java backend server based on Jetty. Each jail has its own internal IP address 127.0.1.x ...
1
vote
1answer
38 views

How to set up a firewall for testing web applications in a virtual machine? [closed]

I'd like to locally test my web application's behavior under different firewall circumstances. We have an application that makes requests from the browser to different ports depending upon certain ...
6
votes
1answer
491 views

NAT outbound IPSEC packets using pf on FreeBSD 11 and StrongSwan x FortiGATE

I've been working for more than a week trying to get outbound packets nat'ed to fit a Security Association. This is my (example) scenario: LAN: 1.1.1.0/24 FreeBSD interface: xn0 (Amazon EC2 ...
1
vote
1answer
280 views

PF Rules to Block All But Accesses to VPN and LAN

The rule set to block all outgoing connections except for VPN access could be like this: block drop all pass on lo0 pass on utun0 pass out proto udp from any to xxx.yyy.zzz.ttt port pppp This works ...
0
votes
2answers
263 views

bsd packet filter on Solaris, why ping not allowed?

I have two interfaces one is net0 with 192.168.0.30 ip the other is vnic0 with 10.2.0.1 ip This is my pf.conf,solaris is 11.4 ext_if="net0" int_if="vnic0" localnet="192.168.0.0/24" internalnet="10.2....
4
votes
3answers
470 views

PF's keep state on UDP packets = security issue?

During the last few days I've read a lot about PF as a nice alternative to iptables and a much more improved and secure way of filtering. Nevertheless I came across the following statement which I ...
3
votes
2answers
261 views

Is there a difference between re0 and wlan0?

I am new to FreeBSD and trying to set up a firewall with pf on my laptop. The machine is connected to the internet via wifi. On writing rule sets in /etc/pf.conf, some tutorials say to spell out the ...
2
votes
1answer
543 views

Why isn't my nat-to not applied to the pass out rule?

I've a strange problem concerning NAT on an OpenBSD-Box with pf. I've cut down my pf.conf to the following lines: extif = "pcn0" intif = "pcn1" block drop all #Allow all incoming traffic from intif ...
1
vote
1answer
259 views

Graph gateway in/out traffic per client

tl;dr: Suppose I have a list of LAN clients (ip/macaddress/name); how would I best go about graphing the traffic going in/out of my OpenBSD 6.1 gateway? In my network everything going in/out of it ...
0
votes
2answers
348 views

Totally open FreeBSD router in VirtualBox

TL;DR - I'd like to set up a FreeBSD VM with one network card on my home LAN (192.168.1.0/24) and one on a private-internal-to-virtualbox network (10.9.9.0/24) and pass any and all traffic back and ...
1
vote
1answer
222 views

Set $ext_if, $int_if, $localnet in PF

I am currently trying to get familiar with the basics of PF on FreeBSD. I am trying to setup the most basic example from the PF chapter in the FreeBSD handbook, the simple bruteforce rules: block ...
1
vote
0answers
60 views

Can a block rule on PF add the src ip to a table

So on iptables I can make deny rules act as honey pots by adding ip's that hit the rules to a list that another rule is used to block all traffic from. I am trying to achieve the same thing on PF, ...
8
votes
2answers
3k views

NAT and source IP filtering in PF, using OpenBSD >= 4.7

I just read a book about PF (The Book Of PF, No Starch), but there's one question not answered by it. If I have a gateway machine using two interfaces, $int_if and $ext_if, and I NAT the packages ...
0
votes
1answer
749 views

Permanently start the OpenBSD pf Firewall on OS X

I use Mac OS X El Capitan 10.11.3 at the desktop OS. As everyone knows, is Apple's Mac OS X built on FreeBSD! I use normal only Debian/GNU/Linux on desktop and OpenBSD on Server and Firewall: So my ...
1
vote
0answers
504 views

FreeBSD load balancer implementation

I have a program, which cannot be used in multiprocess\multithread mode, so it eat one CPU core, others cores are free, but RAM and network bandwidth usage near to 10% from max. The server for the ...
6
votes
1answer
4k views

Block outgoing connections to certain IP using PF

Can someone give me a hint on how to setup a basic deny rule whenever any TCP request is sent to a specific IP address? I am using the PF packet filter. Any help?
1
vote
0answers
558 views

Is it possible? Three OpenBSD 6.0-current firewall bridges with only one OpenBSD Server?

Is it possible to configure several firewall bridges with one OpenBSD server which has 6 nic's. In this case 3 OpenBSD firewall bridges from each other completely independent? cat /etc/sysctl.conf ...
3
votes
1answer
750 views

Freebsd: pf firewall doesn't work on restart

I'm running FreeBSD 10.3 p4 and observed some strange behavior When restarting the machine pf starts due to /etc/rc.conf entry # JAILS cloned_interfaces="${cloned_interfaces} lo1" gateway_enable="...
1
vote
2answers
945 views

Applying NAT to traffic from GRE tunnel in OpenBSD PF

All I have a Cisco 877 router and a Linode VPS running OpenBSD 5.9 with a GRE tunnel running in between, which works great and I can ping from either side. I have set up a static route in the Cisco ...
2
votes
1answer
116 views

Cannot ping OUT of a Mac OS X server

I have just inherited a Mac OS X server that is using pf. The problem I am trying to solve is why I can't ping OUT of the server. I can ping to the machine no worries, but just get timeouts on pinging ...
2
votes
1answer
4k views

pf blocks all in/out traffic instead of just the one port I wanted to block

I need to block one incoming port with pf. I'm new to pf, and I can't figure out what I'm doing wrong here. Here is my entire rule file, made to block incoming port 22: set block-policy drop pass in ...
0
votes
2answers
56 views

Messed up my mac firewall configuration (pf.conf) and ended up with 100% packet loss

I was trying to do wifi throttling for my new app development (new to this) and was trying to do it using iceFloor application. I'm not 100% sure if this is a problem, but i need to confirm if i ...
2
votes
0answers
195 views

pfctl - How to forward ip address in Mac OS Yosemite

How to forward all traffic to an external site 172.16.19.211:5001 to 127.0.0.1:5000 ? These docs have details about port forwarding but still ip forwarding is unclear. http://www.openbsd.org/faq/pf/...
2
votes
2answers
349 views

How do I add more IP addresses to my pf rules?

I wish to have all internet traffic to go through my VPN; when my VPN is disconnected, all internet traffic can not go out of my workstation/desktop (not server). I wish to switch VPN servers of one ...
12
votes
3answers
20k views

How to block abusive IP addresses with pf in OpenBSD?

We can see from the nginx logs that there is an IP address doing nasty things. How can we block it with a pf command and then later permanently with the /etc/pf.log? How can we block a x.x.x.x/24 ...
2
votes
1answer
280 views

“persist” attribute in OpenBSD Tables

According to OpenBSD's FAQs on "Tables" (http://www.openbsd.org/faq/pf/tables.html), without the persist attribute, the kernel will automatically remove the table when the last rule referencing ...
0
votes
1answer
127 views

set up pfctl to forbid local applications accessing a specific hostname

I am an OSX user, and I want to ban some hostnames, with which some local applications may do nasty things. pfctl is the default firewall on OSX 10.11 El captain. So, how to block the specific ...
1
vote
1answer
301 views

Configuring OpenBSD's PF as a router

I am running OpenBSD 4.4, I copied the template from https://markshroyer.com/guides/router/ch07.html for /etc/pf.conf and edited it to match my network. When I start it I get syntax errors on only ...
2
votes
1answer
157 views

on FreeBSD, how do I open a port on WAN but not on LAN?

I have one FreeBSD machine that I use as a playbox/server/torrentbox. It's part of my LAN. Here is the semantics (altered from an example on the OpenBSD website): [ desktop ] [ laptop ] | ...
1
vote
0answers
832 views

Can not divert packet to pf when configure transparent squid 3.4.13 on OpenBSD 5.7

I am trying to build transparent proxy with squid on OpenBSD 5.7 with pf firewall. I compile squid from sources with options: $ squid -v Squid Cache: Version **3.4.13** configure options: --prefix=...
2
votes
1answer
5k views

Routing a LAN through OpenVPN on OpenBSD 5.5

I'm configuring an OpenVPN gateway to allow a LAN access to the internet through the tunnel. The gateway is running OpenBSD 5.5-stable amd64 on the PC Engines APU platform. The LAN contains re1, re2, ...
0
votes
1answer
523 views

ip_conntrack and FreeBSD

We can figure out number of connections in GNU\Linux with ip_conntrack module, And I can print current connections and maximum of connections with: root@debian:/home/mohsen/test/shell# sysctl net....
2
votes
1answer
1k views

macos - local port redirection using pfctl and syntax errors

I am running MacOS(really BSD), and I want to redirect certain traffic over an ssh tunnel using a a local forward. Seems easy enough, but I am repeatedly blocked by the ambiguous "/etc/pf.conf:29: ...
4
votes
3answers
888 views

OpenBSD's pf: disable network access for a given user, except for ssh.

If we are using the default firewall for OpenBSD, how can we modify it to disable all the network access for a normal user except for one thing: we want to ssh to the user from random hosts! So ...
1
vote
1answer
54 views

How to only allow a group for network access?

Using OpenBSD's pf. Question: How can we modify the firewall of OpenBSD to allow ONLY a given group for network access? If somebody isn't in that group, it shouldn't have layer 3 or layer 2 network ...
3
votes
1answer
125 views

Reject packets in pf after a connection consumed a certain amount of traffic

In pf you can limit the bandwidth that is consumed (by for example ssh) using queues. I am hosting a UDP Service (Discard Protocol) which can easily eat up all my traffic when a client transfers ...
2
votes
0answers
737 views

I have a firewall bridge in pfSense and I want to log only the allowed packet

I have a bridge0 which has members em0 (wan) and vge0 (lan) I connect via ssh on vge0, when I tcpdump -i pflog0 I get the blocked packets from the bridge0, but when I tcpdump -i bridge0 I get both ...
1
vote
1answer
150 views

TLS and Packet Filtering

I want to set up a client wit BSD packet filtering that only allows outgoing 443 connections. Would this do the trick in my pf.conf? block out block in pass out on eth0 inet proto tcp from (eth0) ...