I'm trying to build an OpenBSD mcahine to reoace an aging OpenBSD machine
thta I use as a firewall between my local network, and the internet. I
atach via a cablemodem.
I've got a pf.conf modifed from one of the faq examples, and it mostly
works.
What doesn't work if outbound ftp. I can ftp out from the firewall itself,
but not from the machines inside the network.
here's my config file:
# $OpenBSD: pf.conf,v 1.21 2003/09/02 20:38:44 david Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# Required order: options, normalization, queueing, translation, filtering.
# Macros and tables may be defined and used anywhere.
# Note that translation rules are first match while filter rules are last match.
# Macros: define common values, so they can be referenced and changed easily.
ext_if="fxp0"
int_if="fxp1"
internal_net="205.159.77.0"
priv_nets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
black="205.159.77.224"
cindy="205.159.77.225"
teddy="205.159.77.231"
# Tables: similar to macros, but more flexible for many addresses.
#table <foo> { 10.0.0.0/8, !10.1.0.0/16, 192.168.0.0/16 }
table <dns_machines> { $black, $cindy }
table <www_machine> { $black }
table <mail_machine> { $black }
table <dcc_machines> { $teddy }
table <mail_readers> { $teddy }
table <ssh_machine> { $teddy }
tcp_services = "{ ssh, smtp, www, domain }"
icmp_types = "echoreq"
set loginterface $ext_if
# Normalization: reassemble fragments and resolve or reduce traffic ambiguities.
scrub in all
# nat/rdr
nat on $ext_if from $int_if:network to any -> ($ext_if)
rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021
rdr on $ext_if proto tcp from any to any port $tcp_services -> $black
# filter rules
block all
pass quick on lo0 all
block drop in quick on $ext_if from $priv_nets to any
block drop out quick on $ext_if from any to $priv_nets
pass in on $ext_if inet proto tcp from any to ($ext_if) \
port $tcp_services flags S/SA keep state
pass in inet proto icmp all icmp-type $icmp_types keep state
pass in on $int_if from $int_if:network to any keep state
pass out on $int_if from any to $int_if:network keep state
pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto { udp, icmp } all keep state
Can anyone point out what I'm doing wrong?
Any sugestiosn fo improvemnets are also welcome.
--
"They that would give up essential liberty for temporary safety deserve
neither liberty nor safety."
-- Benjamin Franklin
