On 4/14/05, Kimi Ostro <[EMAIL PROTECTED]> wrote:
> On 4/13/05, stephen <[EMAIL PROTECTED]> wrote:
> > On 4/13/05, Kimi Ostro <[EMAIL PROTECTED]> wrote:
> > > On 4/13/05, stephen <[EMAIL PROTECTED]> wrote:
>
> > > how does your routing table look? netstat -r -n
> > > how about: sysctl -a net.inet.ip.forwarding
> > > and: sysctl -a net.inet.etherip.allow
> > >
> > > net.inet.etherip.allow should be set to 1, if you are using a gif(4)
> > > device, read the man page.
> >
> > The moment I flush my ruleset or pass in/out all traffic, it works
> > 100% so it's not a routing issue, something to do with the pf ruleset.
> > let me know cause I can post it if required.
> >
>
> Funny thing is, once you've figured it out, you'll probbaly kick your
> self.. at the moment, its just infuriating.
tell me about it =]
most of the time when I've been staring at something for so long and I
walk in to work the next day it seems as plain as.. forgotten the rest
of expression, but an obvious mistake I've over looked
> > >
> > > Why do people do this? I am just curious...
> >
> > cause in the shell i've got it sort of tabulated so it's easy to
> > read.. dunno why but thats just how i like it =] (one rule all in
> > one line at time)
> >
>
> you could add a \ at the end of a rule that is too long for coniuation
> on to the next line, example:
>
> pass out on $ext_if inet proto udp \
> from ($ext_if:0) to any port { domain ntp } \
> keep state \
> label "$nr: Out from $srcaddr to $dstaddr:$dstport" \
> queue ( q_def q_pri )
>
> If you place a # just in front of the pass, it comments the whole block!
Yup, saw an example ruleset like that yesterday actually, could
rewrite ruleset to look like this in the future =]
> > it's a bunch of private IP network addresses as specified by most
> > example rulesets (and others I've seen posted here) (i forget which
> > RFC, perhaps 1918? (wild guess))
> >
>
> RFC1918 seems like the one, although to be honest, I tend not to
> bother, when a simple
>
> block drop all on $ext_if
>
> and
>
> antispoof on $ext_if
> antispoof on $int_if
>
> work.
but doesn't antispoof take the network address of your $int_if and
block it on the $ext_if whereas blocking $priv_nets blocks spoofed
attempts from any of those ip ranges?
unlikely it'll be attempted (spoofing a $priv_net ip on my $ext_if)
but can't have that attitude, would rather block it anyway =]
> > > are you running a DNS server? you only need UDP if no
> >
> > I'm not no, but for some reason it didnt want to work with just udp..
> > I do intend to start running a dns caching daemon soon though
>
> Only takes a few seconds *witty remark*
>
> > sure np, I cant connect remotely as you can see by ruleset :P but
> > I'll be sure to post it first thing in the morning whe I get to the
> > office. There have been a few minor changes, as I was attempting to
> > get ftp-proxy going this afternoon and making changes to the conf as I
> > read more documentation.
> >
> >
> > Stephen
> >
>
> Oh, I did notice you didnt give us a uname -a? as pf runs on other
> BSDs besides OpenBSD, suprisingly how different each are too.
really?
I was under the impression it was sortof 'imported' into FreeBSD from
OpenBSD, so the two would be pretty much identical
> ftp-proxy, spent the whole week re-writing my ruleset, tightening up
> the rules and broke ftp (sort of) oh well.
mine's still pretty broke =] having to resort to PASV and a few
users with ftp shortcuts on their desktops can't access the box as
windows doesnt seem to kick back to PASV, just fails when cant get
PORT connection.
here ya go, uname -a & pf.conf =]
FreeBSD bollox.soh.local 5.3-STABLE FreeBSD 5.3-STABLE #2: Mon Mar 7
18:09:46 SAST 2005
[EMAIL PROTECTED]:/usr/obj/usr/src/sys/BOLLOX i386
pf.conf
##### macros
int_if = "rl0"
ext_if = "tun0"
gif_if = "gif3"
icmp_types = "echoreq"
dns = "{ 196.25.1.1 }"
mail1 = "{ dbn.stormnet.co.za }"
mail2 = "{ smtp.saix.net }"
p2p_ports = " { 6346 }"
p2p_clients = "{ 10.0.88.5 , 10.0.88.11 , 10.0.88.12 , 10.0.88.23 }"
studio = "{ 10.0.88.5 , 10.0.88.11 , 10.0.88.12 }"
sh = "10.0.88.23/24"
priv_nets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
soh ="{ 10.0.88.1 , 10.0.88.2 , 10.0.88.3 , 10.0.88.4 , 10.0.88.5 ,
10.0.88.6 , 10.0.88.7 , 10.0.88.8 , 10.0.88.9 , 10.0.88.10 ,
10.0.88.11 , 10.0.88.12 , 10.0.88.13 , 10.0.88.14 , 10.0.88.15 ,
10.0.88.16 , 10.0.88.17 , 10.0.88.18 , 10.0.88.19 , 10.0.88.20 ,
10.0.88.21 , 10.0.88.22 , 10.0.88.23 , 10.0.88.24 , 10.0.88.25 ,
10.0.88.26 , 10.0.88.27 , 10.0.88.28 , 10.0.88.29 , 10.0.88.30 }"
local_net = "{ 10.0.88.0/24 }"
vpn_conf = "{ 196.25.191.237 }"
##### behavior options
set optimization aggressive
set block-policy return
set loginterface $ext_if
set fingerprints "/etc/pf.os"
##### scrub
scrub in all
##### nat/rdr
nat on $ext_if from $int_if:network to any -> ($ext_if)
rdr on $int_if proto tcp from any to any port 80 -> 127.0.0.1 port 3128
rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021
##### anti spoofing protection
#antispoof quick for $int_if inet
#antispoof quick for $ext_if inet
#antispoof quick for lo0
#block drop in on $ext_if from $priv_nets to any
#block drop out on $ext_if from any to $priv_nets
#####filter rules
###default block and log all
block log all
block in quick inet6 all
block out quick inet6 all
pass in quick inet proto icmp all icmp-type $icmp_types keep state
pass out quick inet proto icmp all icmp-type $icmp_types keep state
pass quick on lo0 all
###filter rules for $int_if inbound
block in on $int_if all
#pass in on $int_if from $soh to $int_if keep state
pass in on $int_if inet proto tcp from any to $int_if port 2222 keep state
#pass in on $int_if inet proto tcp from any to $dns keep state
pass in on $int_if proto { udp,tcp } from $int_if:network to any port
= 53 keep state
pass in on $int_if proto tcp from $soh to any port = 3128 flags S/SA
keep state
pass in on $int_if proto tcp from $soh to any port = 443 flags S/SA keep state
pass in on $int_if proto tcp from $int_if:network to $int_if port {
21,20 } keep state
pass in on $int_if proto tcp from $soh to $int_if port 25 keep state
pass in on $int_if proto tcp from $soh to $int_if port 110 keep state
pass in on $int_if proto { udp,tcp } from $int_if:network to any port
6346 keep state
pass in on $int_if proto tcp from $int_if:network to ($ext_if) port {
25,110 } keep state
pass in on $int_if proto tcp from $sh to any port { 6667,6668,7000 }
keep state
pass in on $int_if proto tcp from $int_if:network to $mail1 port {
25,110 } keep state
pass in on $int_if proto tcp from $int_if:network to $mail2 port {
25,110 } keep state
###filter rules for $int_if outbound
block out on $int_if all
#pass out on $int_if all keep state
pass out on $int_if inet proto tcp from $int_if to $int_if:network
port { 20 } keep state
###filter rules for $ext_if inbound
block in on $ext_if all
pass in on $ext_if inet proto tcp from any to ($ext_if) port 20 keep state
pass in on $ext_if inet proto tcp from any to ($ext_if) port 21 keep state
pass in on $ext_if inet proto tcp from any to ($ext_if) port 25 keep state
pass in on $ext_if inet proto tcp from any to ($ext_if) port 110 keep state
#pass in on $ext_if inet proto tcp from any to ($ext_if) port 2222 keep state
pass in on $ext_if inet proto tcp from any port 20 to $ext_if port
55000 >< 57000 flags S/SA keep state
##block nmap's fingerprinting attempt(FIN, URG, PSH)
block in quick on $ext_if inet proto tcp from any to any flags FUP/FUP
###filter rules for $ext_if outbound
block out on $ext_if all
pass out on $ext_if from any to $dns keep state
#pass out on $ext_if inet proto udp from any to $dns keep state
#pass outon $ext_if inet proto tcp from any to $dns port 53 flags S/SA
keep state
pass out on $ext_if inet proto tcp from ($ext_if) to $vpn_conf flags
S/SA keep state
pass out on $ext_if inet proto tcp from ($ext_if) to any port 21 keep state
pass out on $ext_if inet proto tcp from ($ext_if) to any port 20
flags S/AUPRFS keep state
pass out on $ext_if inet proto tcp from ($ext_if) to any port 8021 keep state
pass out on $ext_if inet proto tcp from ($ext_if) to $mail1 port 25 keep state
pass out on $ext_if inet proto tcp from ($ext_if) to $mail1 port 110
keep state
pass out on $ext_if inet proto tcp from ($ext_if) to $mail2 port 25 keep state
pass out on $ext_if inet proto tcp from ($ext_if) to any port 80 keep state
pass out on $ext_if inet proto tcp from ($ext_if) to any port 443 keep state
pass out on $ext_if inet proto tcp from ($ext_if) to any port {
6667,6668,7000 } keep state
pass out on $ext_if inet proto tcp from ($ext_if) to any port 6346 keep state
pass out on $ext_if inet proto tcp from ($ext_if) to any port {
22,2222 } keep state
#pass in inet proto icmp all icmp-type $icmp_types keep state
#pass out inet proto icmp all icmp-type $icmp_types keep state
#pass in on $int_if from $int_if:network to any
#pass out on $int_if from any to $int_if:network
pass in on $gif_if all
pass out on $gif_if all
I was wondering if it is necessary to use keep state like I have?
(virtually everything?) I wrote the conf on the basis of whatever
goes out must come back in and perhaps have over used keep state?
Also wondering if changing keep state to modulate state would be a bad
move? I know the differences between the two but curious if it
would break anything or should I leave as is?
Any comments to improve conf are welcome obviously =]
Thanks,
Stephen
