hi all -
i'm curious as to the behavior the following scenerio is/should be
and what might i do to change it.
quick ruleset:
nat on $ext_if from !($ext_if) -> ($ext_if:0)
block log all
pass in on $int_if proto tcp from $int_if:network to any \
port 22 tag INT_INET flags S/SA modulate state
pass out on $ext_if tagged INT_INET keep state
so here if we initiate a connection from within $int_if:network on
tcp/22 to something out $ext_if, we go through just fine. however,
if i want to initiate a connection *from* the pf device itself on
$ext_if, i will not be able to. so one adds the following:
pass out on $ext_if from ($ext_if:0) to any keep state
so now i can initiate connections from with $inf_if:network as well
as on the pf device towards whatever lies out $ext_if. however, now
the "pass out...tagged INT_INET ..." rule becomes redundant since
the state for the nat is created on the nat rule(well, the ip of
($ext_if:0), so the rule with "...from ($ext_if:0)..." matches.
say something here if i've screwed up my logical and/or tests.
in a situation where one wants to, say...limit outbound ports from
$if_int:network but allow a different set from from ($if_ext:0),
how may one go about that?
does what i'm explaining make sense?
thanks,
okan
--
Okan Demirmen <[EMAIL PROTECTED]>
PGP-Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xB3670934
PGP-Fingerprint: 226D B4AE 78A9 7F4E CD2B 1B44 C281 AF18 B367 0934
