Well, Im close. I have gotten a pf.conf file for my home network that
_almost_ works. One of the remaining problems has to to with redirects to a
machine behind the firewall.
Here's the pf.conf
# $OpenBSD: pf.conf,v 1.21 2003/09/02 20:38:44 david Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# Required order: options, normalization, queueing, translation, filtering.
# Macros and tables may be defined and used anywhere.
# Note that translation rules are first match while filter rules are last match.
# Macros: define common values, so they can be referenced and changed easily.
ext_if="ep0"
int_if="fxp1"
internal_net="205.159.77.0"
priv_nets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
# external_addr="68.59.18.241/32"
black="205.159.77.224"
cindy="205.159.77.225"
teddy="205.159.77.231"
# Tables: similar to macros, but more flexible for many addresses.
#table <foo> { 10.0.0.0/8, !10.1.0.0/16, 192.168.0.0/16 }
table <dns_machines> { $black, $cindy }
table <www_machine> { $black }
table <mail_machine> { $black }
table <dcc_machines> { $teddy }
table <mail_readers> { $teddy }
table <ssh_machine> { $teddy }
tcp_services = "{ ssh, smtp, www, domain }"
icmp_types = "echoreq"
set loginterface $ext_if
set fingerprints "/etc/pf.os"
# Normalization: reassemble fragments and resolve or reduce traffic ambiguities.
scrub in all
# nat/rdr
nat on $ext_if from $int_if:network to any -> ($ext_if)
rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021
rdr on $ext_if proto tcp from any to any port $tcp_services -> $black
# filter rules
block log all
pass quick on lo0 all
block drop in quick on $ext_if from $priv_nets to any
block drop out quick on $ext_if from any to $priv_nets
pass in on $ext_if inet proto tcp from any to ($ext_if) \
port $tcp_services flags S/SA keep state
pass in inet proto icmp all icmp-type $icmp_types keep state
pass in on $int_if from $int_if:network to any keep state
pass out on $int_if from any to $int_if:network keep state
pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto { udp, icmp } all keep state
But, when I try to ssh or point a webroswer to my externa; address, the
conect fails.
Here's the pf.log
Script started on Fri Jan 2 17:44:54 2004
koala# ~/bin/d*
tcpdump: WARNING: pflog0: no IPv4 address assigned
tcpdump: listening on pflog0
Jan 02 17:45:14.345494 rule 0/0(match): block in on ep0: 166.84.1.2.51346 >
205.159.77.224.80: S 2146786831:2146786831(0) win 16384 <mss 1460> [tos 0x80]
Jan 02 17:45:20.009330 rule 0/0(match): block in on ep0: 166.84.1.2.51346 >
205.159.77.224.80: S 2146786831:2146786831(0) win 16384 <mss 1460> [tos 0x80]
Jan 02 17:45:30.482339 rule 0/0(match): block in on ep0: 166.84.1.2.51324 >
205.159.77.224.22: S 3294940186:3294940186(0) win 16384 <mss 1460>
Jan 02 17:45:35.998648 rule 0/0(match): block in on ep0: 166.84.1.2.51324 >
205.159.77.224.22: S 3294940186:3294940186(0) win 16384 <mss 1460>
^C
4 packets received by filter
0 packets dropped by kernel
koala# ^Dexit
Script done on Fri Jan 2 17:45:50 2004
So cleary I need an allow rule for the tcp_services macro, but I can't seem
to get the syntax right for it.
--
"They that would give up essential liberty for temporary safety deserve
neither liberty nor safety."
-- Benjamin Franklin
