Re: trouble with new rdr syntax

2010-10-03 Thread Peter GILMAN

Marcus Larsson k...@mindwipe.org wrote:

 On Tue, Sep 21, 2010 at 10:25:11PM -0400, Peter GILMAN wrote:
 
  can anybody see what i'm missing?  i'd love to score some points
  for openbsd at my job (and i'll fall back to 4.6 if i have to) but
  i'd really love to get this working with 4.7.  any insight would be
  much appreciated.
 
 Hi
 
 You need to allow the traffic out on em1 (I assume traffic to
 $dsan01_grp_ip goes out via that interface).
 
 pass out on $int_if inet proto tcp from any to $dsan01_grp_ip
 port 80

no; according to the man page for pf.conf, if no rule matches the
packet, the default action is to pass the packet.  in other words, all
traffic is allowed by default unless it's explicitly blocked, and my
ruleset does not block any traffic on em1 (in fact, my ruleset has
no rules for em1 at all; the macro is redundant).  traffic is already
allowed out on em1 and does not need a rule to allow it.

thank you anyway for writing.

-

since i wasn't able to make this work, the effort at my job was
abandoned.  i doubt they will let me try openbsd any more.

it's a shame.  somehow, daniel's pf always worked exactly as documented
but ever since henning improved it i can't make it work any more...





Re: trouble with new rdr syntax

2010-10-03 Thread Stuart Henderson
On 2010/10/03 14:24, Peter GILMAN wrote:
 
 Marcus Larsson k...@mindwipe.org wrote:
 
  On Tue, Sep 21, 2010 at 10:25:11PM -0400, Peter GILMAN wrote:
  
   can anybody see what i'm missing?  i'd love to score some points
   for openbsd at my job (and i'll fall back to 4.6 if i have to) but
   i'd really love to get this working with 4.7.  any insight would be
   much appreciated.
  
  Hi
  
  You need to allow the traffic out on em1 (I assume traffic to
  $dsan01_grp_ip goes out via that interface).
  
  pass out on $int_if inet proto tcp from any to $dsan01_grp_ip
  port 80
 
 no; according to the man page for pf.conf, if no rule matches the
 packet, the default action is to pass the packet.

this is true, but note that the implicit pass rule does _not_ keep state.



Re: trouble with new rdr syntax

2010-10-03 Thread Peter GILMAN

Stuart Henderson s...@spacehopper.org wrote:

 On 2010/10/03 14:24, Peter GILMAN wrote:
  
  Marcus Larsson k...@mindwipe.org wrote:
  
   On Tue, Sep 21, 2010 at 10:25:11PM -0400, Peter GILMAN wrote:
   
can anybody see what i'm missing?  i'd love to score some points
for openbsd at my job (and i'll fall back to 4.6 if i have to)
but i'd really love to get this working with 4.7.  any insight
would be much appreciated.
   
   Hi
   
   You need to allow the traffic out on em1 (I assume traffic to
   $dsan01_grp_ip goes out via that interface).
   
   pass out on $int_if inet proto tcp from any to $dsan01_grp_ip
   port 80
  
  no; according to the man page for pf.conf, if no rule matches the
  packet, the default action is to pass the packet.
 
 this is true, but note that the implicit pass rule does _not_ keep
 state.
 

very good observation; thank you.




Re: trouble with new rdr syntax

2010-10-01 Thread Marcus Larsson
On Tue, Sep 21, 2010 at 10:25:11PM -0400, Peter GILMAN wrote:

 can anybody see what i'm missing?  i'd love to score some points
 for openbsd at my job (and i'll fall back to 4.6 if i have to) but i'd
 really love to get this working with 4.7.  any insight would be much
 appreciated.

Hi

You need to allow the traffic out on em1 (I assume traffic to
$dsan01_grp_ip goes out via that interface).

pass out on $int_if inet proto tcp from any to $dsan01_grp_ip
port 80

-- 
Marcus Larsson, Stockholm, Sweden
http://kore.hack.se/contact/