Re: Topics for revised PF and networking tutorial

2017-04-09 Thread Glenn Faustino
Hi All, Here's my config I'm using on my apu2 on my home network: [apu2@apu2.domain.local:~]$ doas cat /etc/pf.conf doas (apu2@apu2.domain.local) password: # $OpenBSD: pf.conf,v 1.54 2014/08/23 05:49:42 deraadt Exp $ # # See pf.conf(5) and /etc/examples/pf.conf # Macros ext_if =

Re: ipv6 router ping6 = good, web = bad

2017-04-09 Thread Edgar Pettijohn
On 04/09/17 16:52, Stuart Henderson wrote: On 2017-04-09, Pierre Emeriaud wrote: 2017-04-09 16:33 GMT+02:00 Edgar Pettijohn : On 04/09/17 04:45, Florian Ermisch wrote: Hi Edgar, check the MTU on your tunnel device. You can give it a try with doas ifconfig gif0 MTU 1400 Unfortunantly t

Re: ipv6 router ping6 = good, web = bad

2017-04-09 Thread Stuart Henderson
On 2017-04-09, Pierre Emeriaud wrote: > 2017-04-09 16:33 GMT+02:00 Edgar Pettijohn : >> On 04/09/17 04:45, Florian Ermisch wrote: >>> >>> Hi Edgar, >>> >>> check the MTU on your tunnel device. >>> You can give it a try with >>>doas ifconfig gif0 MTU 1400 > > >> Unfortunantly that didn't do it.

Re: ipv6 router ping6 = good, web = bad

2017-04-09 Thread Pierre Emeriaud
2017-04-09 16:33 GMT+02:00 Edgar Pettijohn : > On 04/09/17 04:45, Florian Ermisch wrote: >> >> Hi Edgar, >> >> check the MTU on your tunnel device. >> You can give it a try with >>doas ifconfig gif0 MTU 1400 > Unfortunantly that didn't do it. I think I'll just wait until my ISP offers > it.

Re: ipv6 router ping6 = good, web = bad

2017-04-09 Thread Edgar Pettijohn
On 04/09/17 04:45, Florian Ermisch wrote: Hi Edgar, check the MTU on your tunnel device. It has to be lower than the one on your NIC. As DNS and ICMP packets are tiny they will pass through anyway but the browser's TCP connections' packets will max out the configured MTU and get dropped. You can

Re: [relayd] keep origin IP in logs

2017-04-09 Thread Thuban
* Hiltjo Posthuma le [09-04-2017 14:06:48 +0200]: > On Sun, Apr 09, 2017 at 11:30:37AM +, Stuart Henderson wrote: > > On 2017-04-09, Thuban wrote: > > > * Hiltjo Posthuma le [09-04-2017 11:42:23 +0200]: > > >> On Sat, Apr 08, 2017 at 08:48:43PM +0200, Thuban wrote: > > >> > Hello, > > >> > I

Re: [relayd] keep origin IP in logs

2017-04-09 Thread Hiltjo Posthuma
On Sun, Apr 09, 2017 at 11:30:37AM +, Stuart Henderson wrote: > On 2017-04-09, Thuban wrote: > > * Hiltjo Posthuma le [09-04-2017 11:42:23 +0200]: > >> On Sat, Apr 08, 2017 at 08:48:43PM +0200, Thuban wrote: > >> > Hello, > >> > I use relayd to deal with HTTP headers as suggested here [1]. >

Re: [relayd] keep origin IP in logs

2017-04-09 Thread Stuart Henderson
On 2017-04-09, Thuban wrote: > * Hiltjo Posthuma le [09-04-2017 11:42:23 +0200]: >> On Sat, Apr 08, 2017 at 08:48:43PM +0200, Thuban wrote: >> > Hello, >> > I use relayd to deal with HTTP headers as suggested here [1]. >> > My problem is that in httpd logs, the origin IP is 127.0.0.1 and thats >>

Re: [relayd] keep origin IP in logs

2017-04-09 Thread Hiltjo Posthuma
On Sun, Apr 09, 2017 at 11:51:25AM +0200, Thuban wrote: > * Hiltjo Posthuma le [09-04-2017 11:42:23 +0200]: > > On Sat, Apr 08, 2017 at 08:48:43PM +0200, Thuban wrote: > > > Hello, > > > I use relayd to deal with HTTP headers as suggested here [1]. > > > My problem is that in httpd logs, the origi

Re: [relayd] keep origin IP in logs

2017-04-09 Thread Thuban
* Hiltjo Posthuma le [09-04-2017 11:42:23 +0200]: > On Sat, Apr 08, 2017 at 08:48:43PM +0200, Thuban wrote: > > Hello, > > I use relayd to deal with HTTP headers as suggested here [1]. > > My problem is that in httpd logs, the origin IP is 127.0.0.1 and thats > > not very handy to track bruteforce

Re: ipv6 router ping6 = good, web = bad

2017-04-09 Thread Florian Ermisch
Hi Edgar, check the MTU on your tunnel device. It has to be lower than the one on your NIC. As DNS and ICMP packets are tiny they will pass through anyway but the browser's TCP connections' packets will max out the configured MTU and get dropped. You can give it a try with doas ifconfig gif0 MTU

Re: [relayd] keep origin IP in logs

2017-04-09 Thread Hiltjo Posthuma
On Sat, Apr 08, 2017 at 08:48:43PM +0200, Thuban wrote: > Hello, > I use relayd to deal with HTTP headers as suggested here [1]. > My problem is that in httpd logs, the origin IP is 127.0.0.1 and thats > not very handy to track bruteforce attacks (in example). > > Do you have any advice to keep th

Re: OpenBSD as a non-routing access point

2017-04-09 Thread Stefan Sperling
On Sat, Apr 08, 2017 at 09:43:29AM -0500, Jordon wrote: > > > On Apr 8, 2017, at 3:38 AM, Stefan Sperling wrote: > > > > On Fri, Apr 07, 2017 at 05:06:22PM -0500, Jordon wrote: > >> My new wifi adapter finally arrived today (AR9271) so I want to give > >> hostap a > >> try with its new 802.11n

ipv6 router ping6 = good, web = bad

2017-04-09 Thread Edgar Pettijohn
I recently decided to join the ipv6 world. I set up a tunnel since my isp doesn't provide ipv6 yet. I'm almost there. I can ping6 and host -6 from my laptop, but I can't browse the ipv6 web. I appologize in advance if thunderbird screws this up. [Sun Apr 09 03:57:59 edgar@thinkpad:~ ] $ ping6