For the last five years I've had a machine with two NIC's running as an Internet gateway, firewall and proxy server. OS is FreeBSD 8.2-RELEASE.

With the introduction of Squid 3.2 I ran inte a problem that I need help solving.

Squid has now begone to complain about a forwarding loop and I've gotten some help at the FreeBSD mail lists.

The recommendation I've got is a change to one rule. Unfortunately this change gives a syntax error when I try to apply it.

I would very much appreciate some help in understanding why my rules now are creating this loop and how to solve this issue.

Any suggestions are welcome.

Thanks :-)



My pf.conf:

#
# macros
ext_if="xl0"
int_if="bge0"

tcp_services="{ 22, 993, 5910:5917 }"
tcp_priv_services="{ 389, 443 }"
proxy_services = "{ 21, 80 }"
icmp_types="{ echoreq unreach squench timex }"
internal_net = "172.18.0.0/16"
proxy = "172.18.0.1"
# proxy = "127.0.0.1"
# ftp proxy port
ftpproxyport="8021"
proxyport="8080"
vncports="{ 5900, 5901 }"
torrentport="{ 50505 }"

# tables
table <goodguys> persist
table <sshguard> persist

# options
set block-policy return     # ports are closed but can be seen
set loginterface $ext_if

set skip on lo0

# scrub
scrub in

# For ftp proxy
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"

rdr pass proto tcp from any to any port ftp -> 127.0.0.1 port 8080
# rdr pass proto tcp from any to any port ftp -> 127.0.0.1 port 8021


Old rule, that has a forwarding loop
# redirect www trafic to proxy
rdr on $int_if inet proto tcp from $internal_net to any port $proxy_services -> $proxy port 8080


New suggested rule that gives syntax error
# rdr in on $int_if inet proto tcp from ! $proxy to any port $proxy_services -> $proxy $proxyport tag rdr_proxy


# ext_if IP address could be dynamic, hence ($ext_if)
nat on $ext_if from !($ext_if) to any -> ($ext_if)

# filter rules
block in log on $ext_if all

block drop in log quick inet6 all

block drop out log quick inet6 all

block in log quick on $ext_if from <sshguard> label "ssh bruteforce"

# Allow traffic through SQUID
pass in log on $int_if inet proto tcp from $internal_net to $proxy port 8080 keep state

pass out log on $ext_if inet proto tcp from $proxy to any port $proxy_services keep state

# pass out
pass out log

# We need to have an anchor for ftp-proxy
anchor "ftp-proxy/*"

# Let the goodguys access the machine from the outside
pass in log on $ext_if inet proto tcp from <goodguys> to ($ext_if) port $tcp_services flags S/SA keep state

# Torrent trafic on torrent_port
pass in log on $ext_if inet proto tcp from any to ($ext_if) port $torrentport

# We need this for the rdr to VNC (change of portnumber)
pass in on $ext_if inet proto tcp from <goodguys> to $internal_net port $vncports flags S/SA synproxy state

# ICMP answers (traffic) needs to be passed:
pass in inet proto icmp all icmp-type $icmp_types keep state

# traffic must be passed to and from the internal network
pass in log quick on $int_if
#

Reply via email to