Re: need help with pf configuration

2011-10-10 Thread Victor Sudakov
Matthew Seaman wrote: I need no details, just a general hint how to setup such security levels, preferably independent of actual IP addressses behind the interfaces (a :network macro is not always sufficient). You may use urpf-failed instead :network urpf-failed: Any

Re: need help with pf configuration

2011-10-10 Thread Victor Sudakov
Nikos Vassiliadis wrote: I have a configuration with 2 inside interfaces, 1 outside and 1 dmz interface. The traffic should be able to flow 1) from inside1 to any (and back) 2) from inside2 to any (and back) 3) from dmz to outside only (and back). I need no details, just a general hint

Re: need help with pf configuration

2011-10-10 Thread Patrick Lamaiziere
Le Mon, 10 Oct 2011 14:10:53 +0700, Victor Sudakov suda...@sibptus.tomsk.ru a écrit : The problem is, there could be several routed networks behind the inside interfaces. Not all inside networks are directly connected, and the :network macro works only for directly connected interfaces,

Re: need help with pf configuration

2011-10-09 Thread Patrick Lamaiziere
Le Sun, 9 Oct 2011 12:15:54 +0700, Victor Sudakov v...@mpeks.tomsk.su a écrit : I have a configuration with 2 inside interfaces, 1 outside and 1 dmz interface. The traffic should be able to flow 1) from inside1 to any (and back) 2) from inside2 to any (and back) 3) from dmz to outside only

Re: need help with pf configuration

2011-10-09 Thread Victor Sudakov
Patrick Lamaiziere wrote: I have a configuration with 2 inside interfaces, 1 outside and 1 dmz interface. The traffic should be able to flow 1) from inside1 to any (and back) 2) from inside2 to any (and back) 3) from dmz to outside only (and back). I need no details, just a

Re: need help with pf configuration

2011-10-09 Thread Patrick Lamaiziere
Le Sun, 9 Oct 2011 14:39:10 +0700, Victor Sudakov v...@mpeks.tomsk.su a écrit : I need no details, just a general hint how to setup such security levels, preferably independent of actual IP addressses behind the interfaces (a :network macro is not always sufficient). You may use

Re: need help with pf configuration

2011-10-09 Thread Matthew Seaman
On 09/10/2011 10:31, Patrick Lamaiziere wrote: Le Sun, 9 Oct 2011 14:39:10 +0700, Victor Sudakov v...@mpeks.tomsk.su a écrit : I need no details, just a general hint how to setup such security levels, preferably independent of actual IP addressses behind the interfaces (a :network

Re: need help with pf configuration

2011-10-09 Thread Nikos Vassiliadis
On 10/9/2011 10:39 AM, Victor Sudakov wrote: Patrick Lamaiziere wrote: I have a configuration with 2 inside interfaces, 1 outside and 1 dmz interface. The traffic should be able to flow 1) from inside1 to any (and back) 2) from inside2 to any (and back) 3) from dmz to outside only (and

Re: need help with pf configuration

2011-10-09 Thread Victor Sudakov
Patrick Lamaiziere wrote: I need no details, just a general hint how to setup such security levels, preferably independent of actual IP addressses behind the interfaces (a :network macro is not always sufficient). You may use urpf-failed instead :network urpf-failed: Any

need help with pf configuration

2011-10-08 Thread Victor Sudakov
Colleagues, I have a configuration with 2 inside interfaces, 1 outside and 1 dmz interface. The traffic should be able to flow 1) from inside1 to any (and back) 2) from inside2 to any (and back) 3) from dmz to outside only (and back). I need no details, just a general hint how to setup such