PF firewall rule for passing Echolink

johnblue · #1 April 29th, 2009, 05:38

I did some google searching trying to find if anyone else constructed a PF exception for Echolink before I tackled it and the results are fairly sparse.

I, by no means, have a handle on PF, but this pf.conf is working for me. Here is my contribution for anyone else that might be looking too:

Code:

# macros
#
ext_if          = "xl0"
int_if          = "xl1"
localnet        = $int_if:network

# options
#
set loginterface $ext_if

# tables - none
#

# normalization
#
scrub in  on $ext_if all           fragment reassemble
scrub out on $ext_if all random-id fragment reassemble

# Redirect for Echolink
#
rdr on $ext_if proto {tcp,udp} from any to any port 5198:5200 -> 192.168.1.54

# NAT
#
nat on $ext_if from $localnet to any -> $ext_if

pass from { lo0, $localnet } to any

Comments are welcomed.

vivek · #2 April 29th, 2009, 10:03

Usually firewall should be set to block everything and allow only required ports. I do not see you are blocking anything at all...

**SirDice** · #3 April 29th, 2009, 10:37

Quote:

Originally Posted by vivek

Usually firewall should be set to block everything and allow only required ports. I do not see you are blocking anything at all...

PF, by default, blocks everything.

vivek · #4 April 29th, 2009, 11:36

Quote:

Originally Posted by SirDice

PF, by default, blocks everything.

I do not see any info regarding default block @ pf / pf.conf man page or openbsd.org pf faq page. If this is true than why all books and docs asks to put the following:

Code:

# setup a default deny policy
block all

**SirDice** · #5 April 29th, 2009, 16:00

Hmm.. It seems I was confused with IPFilter. That has an pass all implicit rule but can be started with a block all implicit rule.

PF seems to have a "pass all" implicit rule:

Quote:

There is an implicit pass all at the beginning of a filtering ruleset meaning that if a packet does not match any filter rule the resulting action will be pass.

http://www.openbsd.org/faq/pf/filter.html

Implicit rules should never be counted on though. For one there's no accounting done on them and second it's pretty easy to get them the wrong way around (as I've just demonstrated

).

Thread Tools
Show Printable Version Email this Page
Display Modes
Switch to Linear Mode Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Any benefit to running a firewall when I'm already behind one?	osx-addict	Firewalls	14	June 4th, 2009 23:29
pf firewall on virtual image?	Mathurin	Firewalls	0	April 4th, 2009 05:54
Temporarily disable ipfw during rule reload	usdmatt	Firewalls	6	March 26th, 2009 06:33
Dynamic firewall rules	v0idnull	Firewalls	1	December 4th, 2008 00:48