A PF lecture/tutorial - work in progress

) At this point I'm not confident it's publishing quality, but I'd love to hear comments of any kind. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet Bard, Twice

Re: OBSD Bridge Help

to the last version which was able to pass at least some traffic, then introduce rules one at a time from there, testing each change. That way you will be in a much better position to see what breaks, if it does. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http

Re: Sample ruleset for dividing LANs

from $otherlan to any keep state - with the addition of some restriction on which ports and a few other embellishments - could be what you need. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no

Re: Still no answer on my bridge question -- resolved

the lines of now what on g*d's green earth are you doing that for? is a lot less than you think. Posting your config along with your problem description is always good. Obfuscate if you have to. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149

Re: Pfctl for non-root users

/dev/pf It certainly looks like being a member of wheel is a distinct advantage, at least. What kinds of operations did you have in mind? Would eg a sensible authpf setup help achieve what you want to do? -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http

Re: Pfctl for non-root users

Jason Dixon [EMAIL PROTECTED] writes: # su - hatchet $ pfctl -vsr pfctl: /dev/pf: Permission denied $ whoami hatchet $ groups hatchet wheel You asked about running pfctl via sudo, but there's no trace of sudo here. I would think a reasonable sudo config is what you want. -- Peter N. M

Re: Pfctl for non-root users

). So being a wheel member doesn't really matter in this case. A correct sudoers file is probably all that's needed for the OP, the exact contents would of course be up to whatever is appropriate at the site. That, and actually using sudo instead of su - ;) -- Peter N. M. Hansteen, member

Re: Feature request - setting TOS

Kimi Ostro [EMAIL PROTECTED] writes: I would not usually ask for a feature. Anyway, the proposal would be that you could set the TOS on TCP/UDP packets like so: Sounds somewhat like you could achieve at least some of the same effect via altq, with a set of queues and priorities. -- Peter N

Re: Feature request - setting TOS

more faith in the things I can control, on my own gear. Setting TOS values is useful, but only to the extent they are actually honored further down the track. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http

Firewalling with PF manuscript updated, BSD-licensed

, and to the excellent PF developers, OpenBSD and elsewhere. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet Bard, Twice-forwarded tales

Re: tunneling over HTTPS

would be non-trivial to say the least. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet Bard, Twice-forwarded tales

Re: tunneling over HTTPS

alex wilkinson [EMAIL PROTECTED] writes: Is it possible to disguise this behaviour ? From a client perspective. Assuming you have the near-infinite processing resources it would take to make the decrypting and pattern recognition happen without noticeable delay, sure. -- Peter N. M. Hansteen

Re: tunneling over HTTPS

Agency or the Central Intelligence Agency on the list of prerequisites, but thought I'd better not, since that might trigger all sorts of stupidity. oh bummer. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http

Re: Dude about route-to

. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet Bard, Twice-forwarded tales

Re: limitation of PF while forwarding ports --help

, but would not a reasonable NAT combined with something like pass inet proto tcp from $localnet to $Windows_RDServer port 3389 keep state 'just work'? Does the server need to start connections which are not taken care of by the state information back to the clients? -- Peter N. M. Hansteen

Re: natting static IP's

, 192.168.101.0/24 } nat on $ext_if from $myranges to any - ($ext_if) just my NOK 0.02 -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet Bard, Twice-forwarded tales

Re: single box Newbie ques

is, which interface, if any, should I filter on for PPP?. The answer is then tun0 unless I'm very mistaken. Then again, you may not need to reference the interface name at all in a single computer setup. It's possible you would find my PF tutorial at http://www.bgnett.no/~peter/pf/ useful. -- Peter N

Re: Kinds of Attacks

arun kumarn [EMAIL PROTECTED] writes: I want to know which are the type of attacks that are taken care in current version of OpenBSD Pf. I would think that the answer to this depends crucially on the contents of your configuration. -- Peter N. M. Hansteen, member of the first RFC 1149

Re: Internal SSH connection refused when Ext_if dies

setup to compensate for dynamic, and possibly changing, IP addresses on your external interface: nat on $ext_if from $int_if:network to any - ($ext_if) then add options and flags as needed. The () notation should help. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team

Re: What do you think about PF filtering for encapsulated protocols (e.g pppoe) ?

simply filter on the tun interface (usually tun0, but of course you may have more than one). For bridging, look into the brconfig and bridgename.if manpages - the bridge plus pf combination is quite flexible. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http

Is a 'PF default to block' setting outside pf.conf a desirable feature?

is a desirable feature. For a bit of context, the thread in question starts at [EMAIL PROTECTED] -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet Bard, Twice

Re: Is a 'PF default to block' setting outside pf.conf a desirable feature?

/rc. The minimal default rule set AFAICS is the smart solution to the problem. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet Bard, Twice-forwarded

Re: Is a 'PF default to block' setting outside pf.conf a desirable feature?

if you know your way around rcNG. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet Bard, Twice-forwarded tales

Re: Is a 'PF default to block' setting outside pf.conf a desirable feature?

, though. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet Bard, Twice-forwarded tales

Re: pf security - is pf failsafe if config file invalid?

of what you expect from a startup script. Which means essentially an empty or invalid pf.conf will leave you with a system where you are able to log in, unless of course you managed to break your network in other ways. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http

Re: Is a 'PF default to block' setting outside pf.conf a desirable feature?

. The problem seems to be that the /FreeBSD/ PF port for some reason did not bring over the pre network interface rc bits from OpenBSD. I haven't checked the others (NetBSD, DragonFlyBSD), so I'm not sure what the status is there. Anyway the 'window of opportunity' would be ahem, rather small. -- Peter N

Re: pf and Microsoft Exchange IMAPS

you pass imaps on $int_if as well? -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet Bard, Twice-forwarded tales

Re: pf and Microsoft Exchange IMAPS

I'm trying to redirected outside traffic to internal Exchange Server using IMAPS protocol : when you manage to get it working, I would be interested in hearing about it. it might be a useful addition to my PF tutorial. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation

spamd vs the sober worm

in greylisting mode volunteer to do the same tests and send me their results (or raw data for that matter)? Any other feedback would be welcome of course, and truly useful data will merit at least a mention in the thanks to list if this gets published. - P -- Peter N. M. Hansteen, member of the first RFC

Re: PF will not redirect to internal boxes

of the tutorial. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet Bard, Twice-forwarded tales

Re: PF will not redirect to internal boxes

is up at the usual spot (http://www.bgnett.no/~peter/pf/ - Norwegians will have to wait a bit more) -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers

Re: IP accounting (with ipa)

=9053/sam0403j/0403j.htm Then again, the packages you mention may be better suited to your particular needs. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers

Re: ssh bruteforce attempts and timeout of table w/ persist keyword

N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet Bard, Twice-forwarded tales

Re: ssh bruteforce attempts and timeout of table w/ persist keyword

to take care of? as in ext_if = tun0 # macro for external interface - use tun0 for PPPoE int_if = xl1 # macro for internal interface # ext_if IP address could be dynamic, hence ($ext_if) nat on $ext_if from $int_if:network to any - ($ext_if) -- Peter N. M. Hansteen, member of the first RFC

Re: OpenBSD PF firewall on linux

available). [1] For some odd reason these messages were not as easy to find as I had thought, but I'm pretty sure they're in the archives somewhere -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no

Re: PF Feature request: graceful handling of non-lookupable hosts.

. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet Bard, Twice-forwarded tales 20:11:56 delilah spamd[26905]: 146.151.48.74: disconnected after 36099 seconds.

Re: Debugging/troubleshooting rule sets.

accessible after spending some time with my PF tutorial at http://www.bgnett.no/~peter/pf/ (see events.html at the openbsd site for live performances of a slightly revised version). debugging PF rule sets might actually be a good tutorial topic. Noted for later. -- Peter N. M. Hansteen, member

Re: PF Feature request: graceful handling of non-lookupable hosts.

it sounds rather attractive though. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet Bard, Twice-forwarded tales 20:11:56 delilah spamd[26905

Re: Solution Request: I need to initiate outbound PPTP requests thru FreeBSD firewall

other way to do what they needed. (Microsoft - no, there's always an easier way :)) -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet Bard, Twice-forwarded

Re: Solution Request: I need to initiate outbound PPTP requests thru FreeBSD firewall

into the logic issues here. The readability issues are probably byproducts of using a GUI tool, so I won't beat you over the head with them just yet. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no

Re: ftp-proxy, and one nic: oh my...

tutorial at http://www.bgnett.no/~peter/pf/ for a gentle walkthrough. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet Bard, Twice-forwarded tales 20:11

Firewalling with PF tutorial, March 2006 update

://www.bgnett.no/~peter/pf/ are not yet in sync. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet Bard, Twice-forwarded tales 20:11:56 delilah spamd[26905

Re: Confuse with PF rules..

a NAT rule in your config as well. - have you enabled gatewaying (sysctl net.inet.ip.forwarding=1)? -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet

Re: Confuse with PF rules..

you better in the end. My rant about this is at http://www.bgnett.no/~peter/pf/en/basicgw.html (part of a PF tutorial). -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all

Re: Migration document for people coming from IPFilter?

/32 portmap tcp/udp 1025:65000 map $ext_if 192.168.10.0/24 - 1.2.3.4/32 browsing the IPF howto briefly, I think you should be able to get those done via rdr constructs and matching pass rules. The finer details escape me, though. -- Peter N. M. Hansteen, member of the first RFC 1149

Re: Migration document for people coming from IPFilter?

[EMAIL PROTECTED] (mouss) writes: map != rdr. ipf != pf. .? -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet Bard, Twice-forwarded tales 20:11:56

Re: Migration document for people coming from IPFilter?

be easier to help if you could explain what you want to do (ie make sure service Y requests from network Z reach computer X in my NATed LAN). -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First

Re: Migration document for people coming from IPFilter?

can see, so would carry over with minor adjustments. Hope this helps, [1] the tutorial is a work in progress, with a reasonably up to date version posted at http://www.bgnett.no/~peter/pf/. For the ftp part, see the section http://www.bgnett.no/~peter/pf/en/ftpproblem.html -- Peter N. M

Re: Passive FTP error after restart machine..

of a putty.exe equipped machine elsewhere, it all started working again in that particular case. Given the stability of the platform running putty.exe, this has happened more than once. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http

Re: PF inadequacy: queue download

that obviously good or b) you need to work a bit more on that explanation. Abuse and name-calling never helps your case, ever. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we

Re: Open BSD 3.9 unable to send email with attachment thru pf

, and so on. There are several more ways to misconfigure a machine so it will produce the rather bizarre symptoms you are describing, but from the information you are volunteering it's pretty much impossible to tell what is causing the situation. -- Peter N. M. Hansteen, member of the first RFC 1149

Re: pf default deny compile-time option?

on something mission critical a continent away, 'glutton for punishment' comes to mind. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet Bard, Twice-forwarded

Re: PF Table Size - Sanity Check

are tuneable via pf.conf 'set limit' options. I forget what the default max table size is, but the pf.conf man page contains the magic to set it to 100,000 entries. Going from there should be straightforward. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http

EuroBSDCon 2006 PF tutorial online

them to point to the new address http://home.nuug.no/~peter/pf/ instead. File and subdirectory names remain the same. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill

Re: ext_if, int_if?

pass from self to any keep state or pass from 10.12.14.0/24 to any port ssh keep state it's extremely flexible really. The reason you see interface name macros so often is that people tend to find them useful, but you can do without them entirely if you like, I suppose. -- Peter N. M. Hansteen

Re: ext_if, int_if?

://home.nuug.no/~peter/pf/en/whatsyourlocalnet.html -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet Bard, Twice-forwarded tales 20:11:56 delilah spamd

Re: Any set ?

/, specifically http://home.nuug.no/~peter/pf/en/tables.html, and of course man pfctl is your dearest friend :) -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers

Re: Squid 2.6 transparent proxy with pf

Dominik Zalewski [EMAIL PROTECTED] writes: I have OpenBSD 4.0 firewall and I would like to redirect all outgoing http requests to my squid web proxy. Daniel Hartmeier wrote about this a while back, his article can be found at http://www.benzedrine.cx/transquid.html -- Peter N. M. Hansteen

Re: Squid 2.6 transparent proxy with pf

pass on $int_if proto tcp from any to any port 80 - $squid port 8080 I would supplement this with a 'no rdr' rule for the proxy generated traffic. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no

Re: help in configuring icmp rules

of icmp codes too, 'host-unr' would be a valid member of your list of codes. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet Bard, Twice-forwarded tales

Re: Fair distribution of borrowed bandwidth with a lot of users

constructs -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ First, we kill all the spammers The Usenet Bard, Twice-forwarded tales delilah spamd[29949]: 85.152.224.147: disconnected after 42673

Re: PF and forwarding to dmz

bad either. Cheers, -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ Remember to set the evil bit on all malicious network traffic delilah spamd[29949]: 85.152.224.147: disconnected after 42673

Re: states handling

around the problem by omitting direction (implicitly writing rules for both inbound and outbound traffic), ie block inet from 192.168.0.1 to 192.168.114.31 pass inet from 192.168.114.31 to 192.168.0.1 flags S/SA keep state -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team

Re: states handling

logical perspective if you think of it. That's why I spend so much time hammering that in during the relatively basic PF tutorial I've been giving. (yes, the one at http://home.nuug.no/~peter/pf/). -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://bsdly.blogspot.com

Re: pfctl limits on number of tables

upon too. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://bsdly.blogspot.com/ http://www.datadok.no/ http://www.nuug.no/ Remember to set the evil bit on all malicious network traffic delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.

Re: linux/iptables/proxy arp to pf/redundant firewall

main redundancy feature off the table. Why not just a carp/pfsync setup? -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://bsdly.blogspot.com/ http://www.datadok.no/ http://www.nuug.no/ Remember to set the evil bit on all malicious network traffic delilah spamd[29949

Re: linux/iptables/proxy arp to pf/redundant firewall

be totally desirable, bu then it's possible I'm just being incredibly dense. I think I'd need more information about your setup such as addresses and netmasks to offer any input on that. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://bsdly.blogspot.com/ http

Re: PF, limit remote clients by total bandwidth used over time

a lot closer to a solution that would fit the basic requirements, ie adding flexibility without adding clutter to the system at the same time. Just my EUR 0.02, and maybe better ideas will be had by morning. All the best, -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team

Re: hoststated

. Sorry. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/ Remember to set the evil bit on all malicious network traffic delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.

Re: Pass rule from subnet to external

and destination addresses respectively. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/ Remember to set the evil bit on all malicious network traffic delilah spamd[29949]: 85.152.224.147: disconnected after 42673

Re: New pf install on Freebsd seem to be a slow starter.

addresses (say, with a script that checks if each name resolves, then adds the returned addresses to the table). Brittle, but with a fighting chance of working. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no

A PF Certification - what do you think?

certification', and of course any input on what the task and skills spec should contain. [1] http://www.bsdcertification.org/index.php?NAV=FAQ#Q04 -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/ Remember to set

Re: pf overload keyword for TCP only?

to study the actual traffic and the inevitable tweaking of the parameters such as lowering number of allowed connections. - P -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/ Remember to set the evil bit

Re: dual ISP puzzle

Michael Grigoni michael.grig...@cybertheque.org writes: Please let us know what IRC server and channel you found for 'pf' discussions; it would be very useful. FreeNode has a #pf channel. relatively low volume, at times quite useful. -- Peter N. M. Hansteen, member of the first RFC 1149

Re: max-src-port-states to limit 1:N source port states???

hu st hust...@yahoo.com writes: So could pf limit the maximum number of simultaneous state entries that a single source IP's source port can create with a rule? (borrow from man pf.conf :)) max-src-states? (see STATEFUL TRACKING OPTIONS in man 5 pf.conf) - P -- Peter N. M. Hansteen, member

Re: syntax error while using scrub with OpenBSD 4.6

tcp) or some variation (some other parameters are possible). It's in the official docs, but not all the other resources out there that your favorite search engine will turn up have caught up with the news yet. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http

Re: pf is blocking too much connections?

. One random thought - does your rule set include such things as limits on max number of connections? Pure speculation, of course, but it is one of many situations would fit the symptoms you describe. - Peter -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http

Re: Restricting source with dDNS (dynamic DNS)

that change with some frequency. Is there a straightforward way to incorporate dynamic ip source addresses in the pf ruleset? I'd say this sounds like a situation where authpf could come in quite handy. - P -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http

Re: Restricting source with dDNS (dynamic DNS)

that comes with pf. but you're right, it requires ssh to be accessible in order to log in, and so may not be what the original poster was looking for. -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/ Remember

Re: Restricting source with dDNS (dynamic DNS)

. One could of course argue that a little sshd config would go a long way too, say enabling key based logins only (turning off password authentication) and disallowing root logins so on, but we don't know whether they've done that already. - Peter -- Peter N. M. Hansteen, member of the first RFC

Re: Suggestion for a new feature, port code

, and that may still happen given enough round tuits. In the meantime, the main points have already been presented. - Peter -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/ Remember to set the evil bit

Re: throttle traffic by amount of time or amount of used traffic in GB?

/labelstats.html and also covered in The Book of PF (http://nostarch.com/pf2.htm and at better bookstores) -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/ Remember to set the evil bit on all malicious

Re: IP Filter Documentation.

told you). - Peter -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/ Remember to set the evil bit on all malicious network traffic delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.

How not to ask questions + some resources (was: Re: IP Filter Documentation.)

out of (http://home.nuug.no/~peter/pf/, which links to full text versions plus recent slides from conferences that cover more than the BSD-licensed tutorial text). - Peter -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://bsdly.blogspot.com/ http://www.bsdly.net

Re: PF Once rules are not removed from main anchor

developers in general, but quite possibly some of the relevant developers read this as well. - P -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/ Remember to set the evil bit on all malicious network