Re: Firewall setup

2024-04-16 Thread Michel von Behr
May I suggest relaying these more basic questions to @rookies mail-list? I think it would be great if we could have this channel reactivated, dedicated to help folks like Karel learn how to navigate more basic stuff, and keep misc@ for intermediary / advanced users inquiries. On Wed, 17 Apr 2024

Re: Firewall setup

2024-04-16 Thread Daniel Ouellet
On 4/16/24 10:27 AM, Karel Lucas wrote: First and most importantly, I would like to apologize to anyone who was disturbed by my conversation. It is not my intention to offend people. I may be curt, but that's not because it's in my character. In daily life I work with electronics and

Re: Firewall setup

2024-04-16 Thread Karel Lucas
This is my dmesg, if anyone is interested: OpenBSD 7.4 (GENERIC.MP) #3: Wed Feb 28 06:23:33 MST 2024 r...@syspatch-74-amd64.openbsd.org:/usr/src/sys/arch/amd64/compile/GENERIC.MP real mem = 4047122432 (3859MB) avail mem = 3904729088 (3723MB) random: good seed from bootblocks mpath0 at root

Re: Firewall setup

2024-04-16 Thread Karel Lucas
First and most importantly, I would like to apologize to anyone who was disturbed by my conversation. It is not my intention to offend people. I may be curt, but that's not because it's in my character. In daily life I work with electronics and computers and am much less familiar with

Re: Firewall setup

2024-04-16 Thread Zé Loff
On Tue, Apr 16, 2024 at 12:01:38AM +0200, Karel Lucas wrote: > > Op 15-04-2024 om 22:20 schreef Peter N. M. Hansteen: > > On Mon, Apr 15, 2024 at 10:09:31PM +0200, Karel Lucas wrote: > > > This gives the following error messages when booting: > > > no IP address found for igc1:network > > >

Re: Firewall setup

2024-04-15 Thread Peter N. M. Hansteen
I give up. The obviously incomplete, hand edited ifconfig output shows three interfaces that are (or appear to be, judging from the excerpts that we are given) not configured with IP addresses, two of which have a link, while the last does not. For reasons unknown these three are joined in a

Re: Firewall setup

2024-04-15 Thread Stuart Henderson
On 2024-04-15, Karel Lucas wrote: > /etc/hostname.bridge0: > add igc0 add igc1 add igc2 blocknonip igc0 blocknonip igc1 blocknonip > igc2 up bridging with PF is an advanced topic, please get familiar with PF on a standard routed firewall first -- Please keep replies on the mailing list.

Re: Firewall setup

2024-04-15 Thread Karel Lucas
Op 15-04-2024 om 22:20 schreef Peter N. M. Hansteen: On Mon, Apr 15, 2024 at 10:09:31PM +0200, Karel Lucas wrote: This gives the following error messages when booting: no IP address found for igc1:network /etc/pf.conf:41: could not parse host specification no IP address found for igc2:network

Re: Firewall setup

2024-04-15 Thread Karel Lucas
That's a possibility I hadn't thought of yet. But how do I do that, and on which page can I find that in your book? Op 15-04-2024 om 22:17 schreef Peter N. M. Hansteen: The other option - if your network layout is such that it makes sense to treat them to the same rule criteria - would be to

Re: Firewall setup

2024-04-15 Thread Karel Lucas
Op 14-04-2024 om 21:57 schreef Jens Kaiser: Hello Karel, if you want to start simply, then I would recommend to remove all marcos from your pf.conf which are not referenced. You can add them later if needed. As already state by others, there is a syntax error in marco martians. If there are

Re: Firewall setup

2024-04-15 Thread Peter N. M. Hansteen
On Mon, Apr 15, 2024 at 10:09:31PM +0200, Karel Lucas wrote: > This gives the following error messages when booting: > no IP address found for igc1:network > /etc/pf.conf:41: could not parse host specification > no IP address found for igc2:network > /etc/pf.conf:42: could not parse host

Re: Firewall setup

2024-04-15 Thread Peter N. M. Hansteen
On Mon, Apr 15, 2024 at 10:01:59PM +0200, Karel Lucas wrote: > They both give a syntax error by booting. > > Op 14-04-2024 om 17:45 schreef Zé Loff: > > pass in on $int_if proto udp to port 53 > > pass in on $int_if proto udp to $nameservers port 53 You're not giving us a lot to work

Re: Firewall setup

2024-04-15 Thread Karel Lucas
This gives the following error messages when booting: no IP address found for igc1:network /etc/pf.conf:41: could not parse host specification no IP address found for igc2:network /etc/pf.conf:42: could not parse host specification Op 14-04-2024 om 19:59 schreef Peter N. M. Hansteen: On Sun,

Re: Firewall setup

2024-04-15 Thread Karel Lucas
They both give a syntax error by booting. Op 14-04-2024 om 17:45 schreef Zé Loff: pass in on $int_if proto udp to port 53 pass in on $int_if proto udp to $nameservers port 53

Re: Firewall setup

2024-04-14 Thread deich...@placebonol.com
I'm a long time network engineer/firewall admin/make things work on our network when it is broken. First, ICMP Echo Request ( "ping" ) works, you proved that when you sent an Echo Request to a host using it's IP address. The fact that DNS host resolution fails has nothing to do with ICMP Echo

Re: Firewall setup

2024-04-14 Thread Sean Kamath
> On Apr 14, 2024, at 08:09, Karel Lucas wrote: > > Hi all, Hi. > So let's start simple and then proceed step by step. I want to continue with > ping so that I can test the connection to the internet. This works: ping -c > 10 195.121.1.34. But this doesn't work: ping -c 10 www.apple.com.

Re: Firewall setup

2024-04-14 Thread Jens Kaiser
Hello Karel, if you want to start simply, then I would recommend to remove all marcos from your pf.conf which are not referenced. You can add them later if needed. As already state by others, there is a syntax error in marco martians. If there are syntax errors in pf.conf, the rules are not

Re: Firewall setup

2024-04-14 Thread Peter N. M. Hansteen
On Sun, Apr 14, 2024 at 05:09:01PM +0200, Karel Lucas wrote: > Hi all, > > Everything about PF is all very confusing to me at the moment, so any help > is appreciated. So let's start simple and then proceed step by step. I want > to continue with ping so that I can test the connection to the

Re: Firewall setup

2024-04-14 Thread Michael Lambert
There is a typo on the second line of the martians definition (spurious comma and space). Michael > On Apr 14, 2024, at 11:09, Karel Lucas wrote: > > Hi all, > > Everything about PF is all very confusing to me at the moment, so any help is > appreciated. So let's start simple and then

Re: Firewall setup

2024-04-14 Thread Zé Loff
On Sun, Apr 14, 2024 at 05:09:01PM +0200, Karel Lucas wrote: > Hi all, > > Everything about PF is all very confusing to me at the moment, so any help > is appreciated. So let's start simple and then proceed step by step. I want > to continue with ping so that I can test the connection to the