hmmm, I thought that's what i did:
pass in on $EXT inet proto tcp from any to $DMZ:network \
port $INT_TO_DMZ flags S/SA keep state
#pass in on external interface (internet) to my dmz (allowed internet to dmz ports
only)
#then also udp:
pass in on $EXT inet proto udp from any to any \
port $INT_TO_DMZ keep state
#ok, now on dmz interface
pass in on $DMZ inet proto { tcp, udp } all
pass out on $DMZ inet proto { tcp, udp } all
#then pass out on external interface again:
then my last rules (sorry, not included in original email):
pass out on $EXT inet proto { tcp, udp} all
but that also doesn't explain why some traffic is passing and
the the seemingly same traffic is being blocked,...
On Mon, Aug 30, 2004 at 04:24:01PM -0400, David Chubb wrote:
> When you do "Block All" you have to pop holes not just for the $EXT
> interface but also for the $INT or $DMZ as well. The filtering happens on
> *all* interfaces in the box.
>
> Try adding these lines:
>
> pass in on $INT from any to $INT_NET
> pass out on $INT from $INT_NET to any
>
> (and if you have separate DMZ interface)
> pass in on $DMZ from any to $DMZ_NET
> pass out on $DMZ from $DMZ_NET to any
>
> --David Chubb
>
> Support Technician
> =======================
> Virpack Inc.
> 1715 Pratt Drive Suite 3600
> Blacksburg, VA 24060
> Phone: 540-961-9160
> Cell: 540-449-3308
> E-mail: [EMAIL PROTECTED]
> =======================
>
>
>
> > -----Original Message-----
> > From: cmustard [mailto:[EMAIL PROTECTED]
> > Sent: Monday, August 30, 2004 2:19 PM
> > To: [EMAIL PROTECTED]
> > Subject: pf same rule passes some, blocks some?
> >
> >
> > I am stumped by this pf behavior, maybe someone can shed some light.
> >
> > The confusion is this:
> > I have the following macro set up:
> > it passes in, https, and mutella (6346) from the internet to my dmz.
> >
> > INT_TO_DMZ = "{ 443, 6346, 6324 }"
> >
> > It seems to work, because i can attach to some gnutella
> > servers and they to me through 6346, the issue is that i
> > start seeing the
> > following traffic get blocked.
> >
> > rule 1/0(match) block in on rl0: 84.2x.xxx.xx >
> > 192.168.3.2.6346: tcp 0 (DF) rule 1/0(match) block in on rl0:
> > 224.2x.xxx.xx > 192.168.3.2.6346: tcp 0 (DF) to me, this rule
> > says it's blocking traffic on my external interface that is
> > comming from any (internet) and bound for my dmz interface.
> >
> > This behavior confuses me, since some traffic destined for
> > the same ip/port (192.168.3.2:6346) is passed. Why is some
> > getting rejected? I am not blocking any ip's. Yes is rdr'd:
> > ### mutella rdr on $EXT proto udp from any to any port 6324
> > -> $DMZ_IP port 6324 rdr on $EXT proto tcp from any to any
> > port 6346 -> $DMZ_IP port 6346
> >
> > So (to me, it seems, ) a rule like the following should work:
> > pass in on $EXT inet proto tcp from any to $DMZ:network \
> > port $INT_TO_DMZ flags S/SA keep state and
> > pass in on $EXT inet proto udp from any to $DMZ:network \
> > port $INT_TO_DMZ keep state
> >
> > but this leads to the block pf rules above.
> >
> > my first rule (1/0)(match)? is this:
> > # most secure, denies all on all interfaces to start
> > block all
> >
> > # i have tried all the following rules, all with the same result.
> >
> > # what the??? this should work.
> > pass in on $EXT inet proto tcp from any to $DMZ:network \
> > port $INT_TO_DMZ flags S/SA keep state
> >
> > # ok, fine, well, this should totally work!!!
> > pass in on $EXT inet proto tcp from any to any \
> > port $INT_TO_DMZ flags S/SA keep state
> >
> >
> > # ok, maybe it cant pass out???
> > pass in on $EXT inet proto tcp from $DMZ:network to any \
> > port $INT_TO_DMZ flags S/SA keep state
> >
> >
> > # opps, ok, add the udp
> > pass in on $EXT inet proto udp from any to ($EXT) \
> > port $INT_TO_DMZ keep state
> >
> > pass in on $EXT inet proto udp from any to any \
> > port $INT_TO_DMZ keep state
> >
> >
> > # I have even put this for the DMZ nipc rules, which is not
> > desirable but doesnt' seem to make a difference either. pass
> > in on $DMZ inet proto { tcp, udp } all pass out on $DMZ inet
> > proto { tcp, udp } all
> >
> >
> > frig, I'm totally confused,...
> >
> > I would appreciate any insight anyone can provide about this.
> >
> > Thanks.
> >
> > Mus
> >
> > below is relavent part of pf.conf, save bandwidth.
> >
> > # * * * * * * * * * * * * * * * * * * * * * * * * * * * *
> > # pf.conf
> > #
> > # * NETWORK *
> > #
> > # +----------+ +--------------+
> > +-------------+
> > # | Internet |------ rl0 | NAT/firewall | rl1 --------|
> > private |
> > # +----------+ +--------------+
> > +-------------+
> > # rl2 ep0 |
> > # | | |
> > # | |
> > +--- Hub
> > # | +PrivateII (wireless
> > net) |
> > # |
> > |
> > # +-----+
> > +Nodes
> > # | DMZ |
> > # +-----+
> > ##############################################################
> > ################################
> >
> > # Define Macros
> > EXT = "rl0" # internet, not safe
> > PRIV = "rl1" # our private internal network
> > DMZ = "rl2" # dmz, used for emule p2p
> >
> > PRIV_IP = "192.168.5.0/24"
> > PRIV_IP_SERV = "192.168.5.4"
> > DMZ_IP = "192.168.3.2"
> >
> > INT_TO_DMZ = "{ 443, 6346, 6324 }"
> >
> > # ***OPTIMIZATIONS***
> > set optimization normal
> > set block-policy return
> > set loginterface $EXT
> >
> > # *** NORMALIZATION ***
> > scrub in on $EXT all
> >
> > # *** NAT ****
> > nat on $EXT from $PRIV:network to any -> ($EXT) # in '()'
> > for dynamic ip
> > nat on $EXT from $DMZ:network to any -> ($EXT)
> > nat on $EXT from $PRIV_II:network to any -> ($EXT)
> >
> > # redirection, the 'missing link', damn, macros' don't seem
> > to work here,... rdr on $PRIV proto tcp from any to any port
> > 21 -> 127.0.0.1 port 8021 rdr on $PRIV_II proto tcp from any
> > to any port 21 -> 127.0.0.1 port 8021 rdr on $EXT proto tcp
> > from any to any port 443 -> $DMZ_IP port 443 rdr on $EXT
> > proto tcp from any to any port 6323 -> $DMZ_IP port 6323 rdr
> > on $EXT proto udp from any to any port 6324 -> $DMZ_IP port
> > 6324 ### mutella rdr on $EXT proto tcp from any to any port
> > 6346 -> $DMZ_IP port 6346
> >
> > ##############################################################
> > ###############
> > ######################### *** START RULES ***
> > ###############################
> > ##############################################################
> > ###############
> > # most secure, denies all on all interfaces to start
> > block all
> > ############ BLOCK IN ON $EXT (first) ###################
> > block drop in log quick on $EXT all
> > block return-rst in log on $EXT proto TCP all # don't do for
> > udp, just tcp # prevent lan originated spoofing antispoof for
> > $EXT inet ### block anything coming form source we have no
> > back routes for block in from no-route to any ############
> > (next) PASS IN ON $EXT RULES ################### # Allow the
> > local interface to talk unrestricted pass quick on lo0 all
> > pass in on $EXT proto udp from any to any port domain keep state
> >
> > ## ICMP allow lan/firewall to ext $EXT, allows
> > ping/traceroute to interenet pass in on $EXT inet proto icmp
> > all pass in on $EXT inet proto icmp from ($EXT) to any
> > icmp-type 8 code 0 keep state
> >
> > pass in on $EXT inet proto tcp from $DMZ:network to any \
> > port $INT_TO_DMZ flags S/SA keep state
> >
> > pass in on $EXT inet proto tcp from any to $DMZ:network \
> > port $INT_TO_DMZ flags S/SA keep state
> >
> > pass in on $EXT inet proto tcp from any to any \
> > port $INT_TO_DMZ flags S/SA keep state
> >
> > pass in on $EXT inet proto udp from any to ($EXT) \
> > port $INT_TO_DMZ keep state
> >
> > pass in on $EXT inet proto udp from any to any \
> > port $INT_TO_DMZ keep state
> >
> > pass in on $EXT inet proto tcp from any to any \
> > port $INT_TO_DMZ flags S/SA keep state
> >
> > ############ (next) BLOCK OUT ON $EXT RULES
> > ################### block drop out log on $EXT all
> > block return-rst out log on $EXT proto TCP all # don't do
> > for udp, just tcp
> >
> > ############ BLOCK IN ON $DMZ (first) ###################
> > block in log on $DMZ all
> > ############ (next) PASS IN ON $DMZ RULES ###############
> > # UDP Domain requests out - WOW, amazing, cant surf without
> > this!!! pass in on $DMZ proto udp from any to any port domain
> > keep state
> >
> > # ICMP
> > pass in on $DMZ inet proto icmp all
> > pass in on $DMZ inet proto { tcp, udp } all
> >
> > ############ BLOCK OUT ON $DMZ (next) ###################
> > block out log on $DMZ all
> > ############ (next) PASS OUT ON $DMZ RULES
> > ################### pass out on $DMZ inet proto { tcp, udp }
> > all # UDP Domain requests out - WOW, amazing, cant surf
> > without this!!! pass out on $DMZ proto udp from $DMZ:network
> > to any port domain keep state # ICMP pass out on $DMZ inet
> > proto icmp from any to any
> > ############ BLOCK IN ON $PRIV (first) ###################
> > block in log on $PRIV all
> > block return-rst in log on $PRIV proto TCP all # don't do
> > for udp, just tcp
> > ############ (next) PASS IN ON $PRIV RULES
> > ################### pass in on $PRIV proto udp from any to
> > $PRIV:network port domain keep state # send all PRIV request
> > to internet pass in on $PRIV from $PRIV:network to any keep state
> >
> > --
> > [EMAIL PROTECTED]
> > SDF Public Access UNIX System - http://sdf.lonestar.org
> >
--
[EMAIL PROTECTED]
SDF Public Access UNIX System - http://sdf.lonestar.org
