Hello misc@,
WIth a new FTTP connection, I have to use pppoe and a static route for
ipv4. Thse are real routable IPs.
In this example, let's say the connection IP (the one pppoe gets) is
198.51.100.2/32. It gets this on authentication, probably radius/l2tp
on the isp side.
The static route I need to implement is 203.0.113.0/28.
I presume 203.0.113.0/28 will be on the dmz interface not the wan.
Is a pf configuration possible where 198.51.100.2/32 is filtered (let's say
it allows ssh access only) but 203.0.113.0/28 is not?
On FreeBSD pf I'd find the MAC addresses of all the interfaces on all machines
in the dmz then have the following:
~~~~~~~~~~~~~~
# tagging macro
ALLOWED_MAC = "put-mac-addresses-here"
# pass rules
pass quick on $ext_if tagged ALLOWED_MAC
~~~~~~~~~~~~~
As I understand it, OpenBSD pf does not have layer 2 functionality.
Is this understanding still correct?
If it is, how do I spare 203.0.113.0/28 from being processed by pf?
thanks in advance for any advice
--
