On 4/13/05, Kimi Ostro <[EMAIL PROTECTED]> wrote:
> On 4/13/05, stephen <[EMAIL PROTECTED]> wrote:
> > Hi again,
> >
> > After some pondering over my problem re: gif traffic not being able to
> > be sent/received, I've concluded that because gif is tunneled via tun0
> > (my $ext_if), I need to somehow permit gif traffic via $ext_if. I've
> > tried a couple of things but neither seem to help.
> >
>
> how does your routing table look? netstat -r -n
> how about: sysctl -a net.inet.ip.forwarding
> and: sysctl -a net.inet.etherip.allow
>
> net.inet.etherip.allow should be set to 1, if you are using a gif(4)
> device, read the man page.
The moment I flush my ruleset or pass in/out all traffic, it works
100% so it's not a routing issue, something to do with the pf ruleset.
let me know cause I can post it if required.
> > The local network address is 10.0.88.0 and the other end of tunnel is
> > 10.0.89.0
> > Local side of tunnel is 10.0.88.254 and remote end is 10.0.89.254 as
> > shown below:
> >
> > Wed Apr 13 16:53:19 [EMAIL PROTECTED]:~# ifconfig gif3
> > gif3: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1280
> > tunnel inet x.x.y.199 --> x.x.z.214
> > inet 10.0.88.254 --> 10.0.89.254 netmask 0xffffff00
> > inet6 fe80::248:54ff:fed1:3308%gif3 prefixlen 64 scopeid 0x7
> >
> > I've pasted my pf.conf again, and cleaned it up a bit by replacing all
> > the variables I made with what they stand for (ie: '$po' become 'pass
> > out')
> >
> > /etc/pf.conf:
> >
> > ##### macros
> > int_if = "rl0"
> > ext_if = "tun0"
> > gif_if = "gif3"
> > icmp_types = "echoreq"
> >
> > -hosts here-
> >
> > ##### aliases
> > ks = "keep state"
> > ms = "modulate state"
> > ss = "synproxy state"
>
> Why do people do this? I am just curious...
cause in the shell i've got it sort of tabulated so it's easy to
read.. dunno why but thats just how i like it =] (one rule all in
one line at time)
> > int_net = "{" $int_if:network "}"
> >
> > ##### behavior options
> > set block-policy return
> > set loginterface $ext_if
> >
> > ##### scrub
> > scrub in all
> >
> > ##### nat/rdr
> > nat on $ext_if from $int_net to any -> ($ext_if)
> > rdr on $int_if proto tcp from any to any port 80 -> 127.0.0.1 port 3128
> >
> > ##### anti spoofing protection
> > #antispoof quick for $int_if inet
> > #antispoof quick for $ext_if inet
> > #antispoof quick for lo0
> >
> > block drop in on $ext_if from $priv_nets to any
> > block drop out on $ext_if from any to $priv_nets
> >
>
> where is $priv_nets defined? if it is not, it is like saying:
>
> block drop in on $ext_if from to any
> block drop out on $ext_if from any to
>
> I'll let you guess what happens... :o)
it's a bunch of private IP network addresses as specified by most
example rulesets (and others I've seen posted here) (i forget which
RFC, perhaps 1918? (wild guess))
> > #####filter rules
> > ###default block and log all
> > block log all
> > #pass in inet proto icmp all icmp-type $icmp_types $ks
> > #pass out inet proto icmp all icmp-type $icmp_types $ks
> > pass quick on lo0 all
> >
> > ###filter rules for $int_if inbound
> > $bi on $int_if all
> > pass in on $int_if inet proto tcp from any to $int_if port 2222 $ks
> > pass in on $int_if proto { udp,tcp } from $int_net to any port 53 $ks
>
> are you running a DNS server? you only need UDP if no
I'm not no, but for some reason it didnt want to work with just udp..
I do intend to start running a dns caching daemon soon though
> > pass in on $int_if proto tcp from $soh to any port 3128 flags S/SA $ks
> > pass in on $int_if proto tcp from $soh to any port 443 flags S/SA $ks
> > pass in on $int_if proto tcp from $int_net to $int_if port { 21,20 } $ks
> > pass in on $int_if proto tcp from $soh to $int_if port 25 $ks
> > pass in on $int_if proto tcp from $soh to $int_if port 110 $ks
> >
> > pass in on $int_if proto tcp from $int_net to ($ext_if) port { 25,110 } $ks
> >
> > ###filter rules for $int_if outbound
> > block out on $int_if all
> > pass out on $int_if inet proto tcp from $int_if to $int_net port 20 $ks
> >
> > ###filter rules for $ext_if inbound
> > block in on $ext_if all
> > pass in on $ext_if inet proto tcp from any to ($ext_if) port 20 $ks
> > pass in on $ext_if inet proto tcp from any to ($ext_if) port 21 $ks
> > pass in on $ext_if inet proto tcp from any to ($ext_if) port 25 $ks
> > pass in on $ext_if inet proto tcp from any to ($ext_if) port 110 $ks
> >
> > ###filter rules for $ext_if outbound
> > block in on $ext_if all
> > pass out on $ext_if from any to $dns $ks
> > pass out on $ext_if inet proto tcp from ($ext_if) to $vpn_conf flags S/SA
> > $ks
> > pass out on $ext_if inet proto tcp from ($ext_if) to any port 21 $ks
> > pass out on $ext_if inet proto tcp from ($ext_if) to any port 20 $ks
> > pass out on $ext_if inet proto tcp from ($ext_if) to $mail1 port 25 $ks
> > pass out on $ext_if inet proto tcp from ($ext_if) to $mail1 port 110 $ks
> > pass out on $ext_if inet proto tcp from ($ext_if) to $mail2 port 25 $ks
> > pass out on $ext_if inet proto tcp from ($ext_if) to any port 80 $ks
> >
> > pass in inet proto icmp all icmp-type $icmp_types $ks
> > pass out inet proto icmp all icmp-type $icmp_types $ks
> >
> > ###filter to pass all tunnel traffic
> > pass in on $gif_if all
> > pass out on $gif_if all
> >
> > I've had to specify the ports/ hosts seperately for labelling purposes
> > incase anyone wonders why I written it how I have.
> >
> > I'm also struggling to get pflog to show anything (I want it to show
> > everything, not just the blocked traffic, would this implying having
> > 'log' in every rule I have?)... left it running for a while and it
> > showed nothing, even with myself purposely trying to connect to
> > blocked ports (and ofcourse trying to ping via my gif iface)
> >
>
> You would need to add a log parameter to all filtering rules
> (specifically your block rules).
I assumed as much but even with that first rule "block log all" I see
nothing via pflog0
> But for us to really help, we really need your pf.conf verbatim and
> without shortcuts! it is okay to sanitize.. if you are that paranoid.
sure np, I cant connect remotely as you can see by ruleset :P but
I'll be sure to post it first thing in the morning whe I get to the
office. There have been a few minor changes, as I was attempting to
get ftp-proxy going this afternoon and making changes to the conf as I
read more documentation.
Stephen
