Questions tagged [pf]

pf (Packet Filter) is the TCP/IP packet filtering firewall subsystem on BSD systems.

26 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
3answers
470 views

PF's keep state on UDP packets = security issue?

During the last few days I've read a lot about PF as a nice alternative to iptables and a much more improved and secure way of filtering. Nevertheless I came across the following statement which I ...
3
votes
1answer
291 views

Block all traffic out except one port with pfctl for macOS

As stated in the question, I need to block all traffic out to internet except for one port on MAC OS X 10.8.x. I just need the commands to run from a shell or edit any conf file?
3
votes
1answer
232 views

FreeBSD pf firewall, new connections severly delayed when nating

I have a newly setup fbsd 9.1 with pf, which itself doesn't experience any slowness when for example downloading a debian iso from my local debian repo (ftp.se.debian.org). Any machine behind it, ...
2
votes
0answers
196 views

pfctl - How to forward ip address in Mac OS Yosemite

How to forward all traffic to an external site 172.16.19.211:5001 to 127.0.0.1:5000 ? These docs have details about port forwarding but still ip forwarding is unclear. http://www.openbsd.org/faq/pf/...
2
votes
1answer
544 views

Why isn't my nat-to not applied to the pass out rule?

I've a strange problem concerning NAT on an OpenBSD-Box with pf. I've cut down my pf.conf to the following lines: extif = "pcn0" intif = "pcn1" block drop all #Allow all incoming traffic from intif ...
2
votes
0answers
737 views

I have a firewall bridge in pfSense and I want to log only the allowed packet

I have a bridge0 which has members em0 (wan) and vge0 (lan) I connect via ssh on vge0, when I tcpdump -i pflog0 I get the blocked packets from the bridge0, but when I tcpdump -i bridge0 I get both ...
2
votes
0answers
75 views

pf out interface?

I'm trying to figure out how to allow all hosts in $dmz to reach any host when egressing $extif. I can't seem to find the equivalence of netfilters "-o $extif", and I'd like to avoid specifically ...
1
vote
1answer
281 views

PF Rules to Block All But Accesses to VPN and LAN

The rule set to block all outgoing connections except for VPN access could be like this: block drop all pass on lo0 pass on utun0 pass out proto udp from any to xxx.yyy.zzz.ttt port pppp This works ...
1
vote
1answer
223 views

Set $ext_if, $int_if, $localnet in PF

I am currently trying to get familiar with the basics of PF on FreeBSD. I am trying to setup the most basic example from the PF chapter in the FreeBSD handbook, the simple bruteforce rules: block ...
1
vote
0answers
60 views

Can a block rule on PF add the src ip to a table

So on iptables I can make deny rules act as honey pots by adding ip's that hit the rules to a list that another rule is used to block all traffic from. I am trying to achieve the same thing on PF, ...
1
vote
0answers
504 views

FreeBSD load balancer implementation

I have a program, which cannot be used in multiprocess\multithread mode, so it eat one CPU core, others cores are free, but RAM and network bandwidth usage near to 10% from max. The server for the ...
1
vote
1answer
1k views

Slow VPN speed strongswan on FreeBSD

I put up a VPN server with strongswan 5.4.0 on FreeBSD 11.0-RELEASE-p1 on a RaspberryPi 2. So far it works fine, but the speed is varying and also much slower than on Raspian which I used before. ...
1
vote
0answers
559 views

Is it possible? Three OpenBSD 6.0-current firewall bridges with only one OpenBSD Server?

Is it possible to configure several firewall bridges with one OpenBSD server which has 6 nic's. In this case 3 OpenBSD firewall bridges from each other completely independent? cat /etc/sysctl.conf ...
1
vote
0answers
832 views

Can not divert packet to pf when configure transparent squid 3.4.13 on OpenBSD 5.7

I am trying to build transparent proxy with squid on OpenBSD 5.7 with pf firewall. I compile squid from sources with options: $ squid -v Squid Cache: Version **3.4.13** configure options: --prefix=...
1
vote
1answer
54 views

How to only allow a group for network access?

Using OpenBSD's pf. Question: How can we modify the firewall of OpenBSD to allow ONLY a given group for network access? If somebody isn't in that group, it shouldn't have layer 3 or layer 2 network ...
1
vote
1answer
150 views

TLS and Packet Filtering

I want to set up a client wit BSD packet filtering that only allows outgoing 443 connections. Would this do the trick in my pf.conf? block out block in pass out on eth0 inet proto tcp from (eth0) ...
1
vote
0answers
232 views

Perform Cisco's DNS Doctoring on FreeBSD

How to perform a change in the DNS response from a DNS server to be a different IP address than the DNS server actually answered for a given name? http://www.cisco.com/en/US/products/hw/vpndevc/...
0
votes
0answers
32 views

How does route-to work in the BSD pf firewall?

I've recently learned about the route-to functionality in the pf firewall, and I wonder how it works. Is it similar to the "policy-based routing" system in linux? How does route-to allow the ...
0
votes
1answer
86 views

blacklistd not blocking addresses

I've enabled the PF(4) firewall and blacklistd(8). Although IP addresses are being added to to blacklist, I can still see multiple failed attempts from a single IP address. Yet when I test it myself, ...
0
votes
1answer
62 views

macOS pf asymmetric routing through VLANs

I have a VLAN interface vlan0 that has a tag of 444 that has an IP of 172.16.16.16 The VLAN goes through the physical en0 interface. I have another interface mine0 that's local just to the computer....
0
votes
2answers
348 views

Totally open FreeBSD router in VirtualBox

TL;DR - I'd like to set up a FreeBSD VM with one network card on my home LAN (192.168.1.0/24) and one on a private-internal-to-virtualbox network (10.9.9.0/24) and pass any and all traffic back and ...
0
votes
1answer
404 views

pf: Forwarding all packets on port 80 from any interface to SOCKS proxy

I'm trying to forward any packets on port 80 from any interface to my SOCKS proxy (Server). I'm not sure if I have it set up correctly but I can't get it to forward the packets. I create a SOCKS ...
0
votes
2answers
56 views

Messed up my mac firewall configuration (pf.conf) and ended up with 100% packet loss

I was trying to do wifi throttling for my new app development (new to this) and was trying to do it using iceFloor application. I'm not 100% sure if this is a problem, but i need to confirm if i ...
0
votes
1answer
749 views

Permanently start the OpenBSD pf Firewall on OS X

I use Mac OS X El Capitan 10.11.3 at the desktop OS. As everyone knows, is Apple's Mac OS X built on FreeBSD! I use normal only Debian/GNU/Linux on desktop and OpenBSD on Server and Firewall: So my ...
0
votes
1answer
127 views

set up pfctl to forbid local applications accessing a specific hostname

I am an OSX user, and I want to ban some hostnames, with which some local applications may do nasty things. pfctl is the default firewall on OSX 10.11 El captain. So, how to block the specific ...
0
votes
0answers
200 views

Configure FreeBSD pf firewall (non GUI)

I am running Mac OS X 10.10, but my research has led me to the understanding that the particular flavor of pf was ported from FreeBSD. I have tried the popular GUI software (IceFloor) but it is a bit ...