Hot answers tagged

14

The best way to do this is to define a table and create a rule to block the hosts, in pf.conf: table <badhosts> persist block on fxp0 from <badhosts> to any And then dynamically add/delete IP addresses from it: $ pfctl -t badhosts -T add 1.2.3.4 $ pfctl -t badhosts -T delete 1.2.3.4 Other 'table' commands include flush (remove all), replace ...


8

The most basic form would look like this, in your /etc/pf.conf config: block from any to 192.0.2.2 # which is equivalent to: block drop from any to 192.0.2.2 By default this block action will drop packets silently on all interfaces, from any source IP, in both directions. Because a client is unaware it is being blocked it will timeout and likely try again,...


6

I was running a FreeBSD based firewall without problems over many years with this particular issue. If you don't want to perform traffic shaping stuff, you don't need to fix, I would say. Or to say it in a different way: I wouldn't fix it.


5

The problem here is that /etc/rc.d/pf runs before /usr/local/etc/rc.d/ezjail, so the kernel hasn't configured the jailed network by the time it tries to load the firewall rules. You might be tempted to alter the pf script to start after ezjail, but that's not a good idea - you want your firewall to start early in the boot process, but jails get started quite ...


5

As the error message states, you need to add your rdr rule next to the other translation rules on pf.conf. Since there is already a rdr anchor present, the best bet is to put your rdr rule right after it: scrub-anchor "com.apple/*" nat-anchor "com.apple/*" rdr-anchor "com.apple/*" rdr pass inet proto tcp to port 5800 -> 192.168.1.246 port 5900 dummynet-...


4

You set options in pfctl.conf with a set limit { ... } statement. You can modify the packet filter state while it is running by passing the `-m' (merge) option to pfctl(8), ie FreeBSD 9.3-RELEASE-p10 (GENERIC) #0: Tue Feb 24 21:28:03 UTC 2015 # pfctl -sm No ALTQ support in kernel ALTQ related functions disabled states hard limit ...


4

It's not clear from other answers that you need to create an actual table of the badhosts you are trying to block. This goes in the pf.conf file, for example I have two badguys files, 1&2 badguys1 is for those who come and go, and badguys2 is for permanent blacklisting. So if you need to add an ip of someone who is a nuisance for a period of time, add ...


4

After several days struggling I've been able to handle this doing the following steps and will post the solution here to help others Get the unique ID of the desired SA you want to nat source to, example: setkey -DP and find the SA unique ID: 3.3.3.3[any] 2.2.2.2[any] any out ipsec esp/tunnel/REALIPLOCAL-REALIPREMOTE/unique:1 created: Jul 22 ...


3

On FreeBSD the device names are given by the driver, which handles the device. So when you have a RealTek NIC it is controlled by the re driver and to separate multiple NICs which are controlled by the re driver they are numbered starting with 0. See man 4 re. wlan is a different driver for generic Wi-Fi cards. So when you want to write rules for your Wi-...


3

I think you're looking for authpf. http://www.openbsd.org/faq/pf/authpf.html Authpf(8) is a user shell for authenticating gateways. An authenticating gateway is just like a regular network gateway (a.k.a. a router) except that users must first authenticate themselves to the gateway before it will allow traffic to pass through it. When a user's shell is ...


3

I got this information from the website and forgive me for my ill knowledge of OpenBSD, but here it goes. Take a look at this URL. According to it, it states to block an IP you would: echo '123.123.123.123' >> /etc/pf.blocked.ip.conf Then you would restart the firewall: pfctl -d pfctl -e -f /etc/pf.conf Or, to add without restarting the firewall ...


2

You can do it like this with Packet Filter : pass in on em0 proto tcp from any to any port 80 rdr-to 192.168.1.20 port 8000 Change em0 with your network interface, and change the IP address to suit your needs. Read more : http://www.openbsd.org/faq/pf/rdr.html#filter


2

No, you absolutely do NOT need ALTQ to re-route traffic to and from your freebsd jails. I use pf to map traffic on external IPs to the static IPs that my jails run on. The following entries direct traffic to and from the internet to the jails for my mail server: ext_if="bce1" lo_toaster = "127.0.0.6" toaster = "208.75.177.101" nat on $ext_if from $...


2

The issue was an error in the /etc/pf.conf file that prevented the firewall from loading its configuration at all (:network applies to a specific interface). An example of using pf for blocking brute-force connections is given in the OpenBSD PF FAQ, and it boils down to the rules (modified from originally being a www example to something I am using for ssh):...


1

Read up on pflow(4) and related (integrates with pf). You’ll export this NetFlow/IPFIX data to a collector/reporting package of your choosing. I just use nfdump and its related CLI friends, but NfSen is the web UI front end for this.


1

It’s not clear to me why you need a static route on your router, but, regardless, you have no rule in your pf.conf that relates to NAT. Try something like the following after your macros in pf.conf: match out on egress from ! ( egress ) nat-to ( egress ) Or: match out on $int_if from ! ( $int_if ) nat-to ( $int_if ) If those don’t work, post the output ...


1

You're missing pass proto icmp. It's usually a reasonable measure to have as your first pass rule: pass quick proto icmp Otherwise you're implicitly blocking that traffic. ICMP is its own protocol, remember, and not covered by TCP or UDP. See the OpenBSD page on PF.


1

I know it's been a while since this was asked, but here goes: What you're describing in the OP is known as "Hairpin NAT." Instead of adding needless load on your gateway however, what you want to do is let PF handle all the translation. I believe the answer you seek is listed in the first comment on the top answer here: https://serverfault.com/questions/...


1

To answer my own question, I got it to work using the following firewall configuration: # Allow dynaserv jail to access git on https port of web jail pass in on lo1 proto tcp from $ip_jetty to $ip_nginx port https Also, in the /etc/hosts file of the Jetty jail, I added the internal IP address of the Nginx Jail: 127.0.1.1 git.mycompany.com ...


1

You could use fail2ban or similar software, with a custom rule that blocked any IP address that tries to connect to port 22. fail2ban manages automated blocking of hosts making unwanted connections (based on all sorts of criteria, including number of connection attempts, error messages in specific log files, attempts to fetch a particular URL, or pretty ...


1

Blocking LAN access: If pf.conf knows what your LAN subnet is, you can selectively block traffic from it. Using your example: block in all pass out all keep state lan_subnet = "10.0.0.0/24" block in quick proto tcp from $lan_subnet to any port 22 pass in proto tcp from any to any port 22 Rate-limiting WAN but not LAN: Say for example you want to rate-...


1

You can do it : rdr pass quick on $ext_inf inet proto tcp from any to any port 1394 -> $target port 1394


1

This is not possible with pf alone—you’d have to couple it with something like pflow(4) and related to handle the traffic accounting. You might also be able to cook something up with some output from pfctl.


1

I finally found a way to do everything I said before. I'm going to explaining it: In /etc/pf.conf: Denying all incoming trafic (Except the LAN interface) block in all pass in quick on $int_if The first line block eveything while the second one allow anything from the LAN interface. If you wonder what the quick keyword is, read this. How can you be ...


1

I'm no expert but I believe it goes something like this: If your pf rules are static then I don't see a great way to use persist but if they are dynamic (meaning you use anchors in your rules) then rules spring into and out of existence. Persist is what keeps tables alive when the rule set changed and there are no longer any rules that reference them. I ...


1

Use tables. See man pf.conf for a detailed explanation and take a look at this answer for an example.


1

block all pass in on fxp0 proto tcp from any to any port 22 flags S/SA pass out on fxp0 proto tcp from any to any port 22 flags S/SA Please consider you have to change fxp0 to your ethernet according to your operating OS. Reverse of above: pass in on fxp0 proto tcp from any to any port < 22 flags S/SA pass out on fxp0 proto tcp from any to any port <...


1

To PF or not to PF? I do not believe pf is the appropriate place to filter a high level element such as ga.js. Rather it operates a layer or two below that. Filtering ga.js would be better suited to something such as a proxy package such as Squid. excerpt from PF: Packet Filtering Packet filtering is the selective passing or blocking of data packets as ...


1

While I’ve never tried doing what you are doing, the best way to do this with OpenBSD will likely be with tables as you can easy add/remove IPs from tables.


1

DATE=$(date +%Y-%m-%d) HITS=$(sudo tcpdump -n -e -tttt -r /var/log/pflog | grep -c $DATE) echo "$DATE - $HITS" >> /home/pentago/www/pf.txt


Only top voted, non community-wiki answers of a minimum length are eligible