Re: Problems with state syncronisation

Il giorno 14 feb 2005, alle 18:06, Ryan McBride ha scritto: On Mon, Feb 14, 2005 at 10:20:44AM +0100, Andrea Mistrali wrote: Those lines are always relative to broadcast addresses. What can it be? If a packet reaches both firewalls, they will both create state; when they each recieve the state

blocking IP range Q

Hello I need to block certain IP's on my webserver. Can anyone point out how to do that. Here the IP address range I need to block (*-ed out the first three digits) ***.139.192.0 --***.139.223.255 Thanks for the help friends Dom

Borrow not working

Hello, everybody. We've been trying to get borrow to work for us, but despite our reading every reasonable piece of documentation, messages in this list and several web pages - trying to find a solution, it's still not working. We also tried to use the same PF configuration on BSD 3.3 and 3.6,

Re: blocking IP range Q

Sorry the CC: was incorrect. Kim Esben Jørgensen wrote: Hi Dominic Dominic Opferkuch wrote: Hello I need to block certain IP's on my webserver. Can anyone point out how to do that. Here the IP address range I need to block (*-ed out the first three digits) ***.139.192.0 --

bridging, inbound load balancing CARP

Hi all, After some serious head scratching, lots of searching, and much brow furrowing, I can't find an answer to this simple question about bridges and load balancing with OpenBSD: Can one do inbound load balancing between a couple of web servers (box01 box02) when running two OBSD machines as

Re: Can't even do an ls on a FTP server located on the WAN

On Mon, Feb 14, 2005 at 10:53:44PM -0600, eric wrote: On Tue, 2005-02-15 at 00:12:59 +0100, Nicolas proclaimed... I'm trying to connect to an FTP server located on the WAN, from a box which is located in my local network. But I can't even do an ls. I can connect, but then, I can't do

Re: blocking IP range Q

On Tue, Feb 15, 2005 at 09:42:40AM -0800, Dominic Opferkuch wrote: Hello I need to block certain IP's on my webserver. Can anyone point out how to do that. Here the IP address range I need to block (*-ed out the first three digits) ***.139.192.0 --

Good HFSC explanation

Is there a clear HFSC explanation somewhere, with real simple examples? Preferably that apply directly to PF which uses three SC types, not two. I've found plenty of documents, but they're all high-level overview slideshows that are a bit hard to fathom. -- Bob

Re: altq fishiness

Jason Murray wrote: As I understand it the two child ssh queues should just use up all the bandwidth from the parent. I couldn't get CBQ to use up all of the bandwidth. Even when only one queue had any traffic, the bandwidth was never getting saturated. Possibly (probably) it was something

Re: using altq for rate limiting on certain ports across multiple

darren david wrote: My /guess/ is that i need 2 queues - one on $EXT_IF inbound and one on $PRIV_IF outbound. Or perhaps i simply need to be tagging packets? $PRIV_NET is NATed, as one might expect. You seem to be confused, as I was, about the possibilities of the queue mechanism. You

Re: Good HFSC explanation

On Fri, Feb 11, 2005 at 15:39 +, Bob wrote: Is there a clear HFSC explanation somewhere, with real simple examples? Preferably that apply directly to PF which uses three SC types, not two. I've found plenty of documents, but they're all high-level overview slideshows that are a bit

Re: Good HFSC explanation

On Fri, Feb 11, 2005 at 03:39:17PM +, Bob wrote: Is there a clear HFSC explanation somewhere, with real simple examples? Preferably that apply directly to PF which uses three SC types, not two. I've found plenty of documents, but they're all high-level overview slideshows that are a

Re: altq fishiness

On Thu, Feb 10, 2005 at 07:59:31PM +, Bob wrote: I couldn't get CBQ to use up all of the bandwidth. Even when only one queue had any traffic, the bandwidth was never getting saturated. ... Possibly (probably) it was something I was doing wrong. But I've changed to HFSC now, and my

Re: Borrow not working

Alexandre Ilha wrote: Hello, everybody. We've been trying to get borrow to work for us, but despite our reading every reasonable piece of documentation, messages in this list and several web pages - trying to find a solution, it's still not working. We also tried to use the same PF

A PF lecture/tutorial - work in progress

Hi, I've completed an English version of my PF lecture manuscript (with slight updates) originally written for a 1 1/2-2 hour session at BLUG. The material is available in various formats, English: http://www.bgnett.no/~peter/pf/en/pf-firewall.pdf (full manuscript, pdf)

Re: Can't even do an ls on a FTP server located on the WAN

On Tue, Feb 15, 2005 at 07:58:05PM +0100, Nicolas wrote: Post your pf.conf. Unfortunately, the floppy disk is broken on my bastion. Since the pf.conf is around 15ko, I'll avoid typing it... ;-) can you ftp/scp it off and just post on the www somewhere? that sometimes seems to fly for

Re: Can't even do an ls on a FTP server located on the WAN

One more information: When doing a netstat | more, I see that line: tcp 0 0 192.168.14.26.62843 heb62004.ikoula..ftp CLOSE_WAIT I killed ftp-proxy and restarted inetd, but I still get the same problem. Could my problem come from the fact that my network is like that: [FTP

Re: Can't even do an ls on a FTP server located on the WAN

On Tue, Feb 15, 2005 at 06:50:51PM -0700, jared r r spiegel wrote: ... However, here's the rule I added for the FTP: pass in quick on $name_itf_ext inet proto tcp from port 20 to ($name_itf_ext) user proxy flags S/SA keep state ok, that's that.. are you blocking everything by