PF PF: block all does not prevent connection to vnet jailed server

F

Ferocious1881

I am trying to implement as security model for a VNC jail server of only letting connect to the virtual machine from an ssh tunnel.
Which in firewall terms means that only localhost should be able to connect to VNC jail at 10.0.0.10.
Reading pf.conf() and handbook firewalls have concluded that the configuration file at /etc/pf.conf:
Code: 
block drop quick on em0 from any to 10.0.0.10
should block all attempts to connect to the network from outside of localhost and fellow jails, after initiating the firewall with
Code: 
kldload pf pflog
service pf enable
service pf start
service pflog enable
sevrice pflog start
pfctl -F all -f /etc/pf.conf
should prevent all connection attempts outside the localhost, but have been able to connect to the jail vnc server from other machines in the network. And when checking with nmap the vnc port is reported as open.

Want to note that I have also tried with the rule: block in drop quick on em0 from any to 10.0.0.10

Here is the output of ifconfig in the host
Code: 
em0: flags=1008943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        options=8209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC,LINKSTATE>
        inet 10.0.0.2 netmask 0xffffff00 broadcast 10.0.0.255
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
lo0: flags=1008049<UP,LOOPBACK,RUNNING,MULTICAST,LOWER_UP> metric 0 mtu 16384
        options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
        inet 127.0.0.1 netmask 0xff000000
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2
        groups: lo
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
pflog0: flags=1000141<UP,RUNNING,PROMISC,LOWER_UP> metric 0 mtu 33152
        options=0
        groups: pflog
bridge0: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        options=10<VLAN_HWTAGGING>
        inet 10.0.0.108 netmask 0xffffff00 broadcast 10.0.0.255
        id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
        maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
        root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
        bridge flags=0<>
        member: epair10a flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                port 5 priority 128 path cost 2000 vlan protocol 802.1q
        member: em0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                port 1 priority 128 path cost 200000 vlan protocol 802.1q
        groups: bridge
        nd6 options=9<PERFORMNUD,IFDISABLED>
epair10a: flags=1008943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        description: jail:rdesk
        options=200019<RXCSUM,VLAN_MTU,VLAN_HWTAGGING,RXCSUM_IPV6>
        groups: epair
        media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
        status: active
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>

Update:
Trying with pfctl -s rules as
Code: 
block drop quick inet from any to 10.0.0.10
still does not block any attempt to connect to vnc from another computer.

Update:
Furthermore when blocking all communications except ssh as in haling pfctl -s rules as
Code: 
block drop all
pass proto tcp from any to any port = ssh flags S/SA keep state
block drop quick inet from any to 192.168.1.171
It does not prevent any kind of connection to the jailed vnc server.
 
With pf the last matching rule wins - but quick overrules that.

Are there other rules in your rule set? Maybe some other rule lets the traffic through?

You've enabled logging, so add the log keyword and have a look at the logs.

Use
Code: 
pfctl -sr
to see what rules were created from your configuration.
 
richardtoohey2 said:
Are there other rules in your rule set? Maybe some other rule lets the traffic through?
Click to expand...
Only rule.
richardtoohey2 said:
Use pfctl -sr to see what rules were created from your configuration.
Click to expand...
Here is:
Code: 
block drop quick on em0 inet from any to 10.0.0.10
richardtoohey2 said:
You've enabled logging, so add the log keyword and have a look at the logs.
Click to expand...
Have not touched logging options, so far nothing that mentions the device from which connected, but should not, to the vnc server at /var/log/pflog.
 
You've enabled and started pflog, so I think if you add "log" to your block statement you should see what is being blocked by that rule.

If you are not seeing the traffic you expect to be blocked in the logs, then something else is going on.

Your rule is for traffic "to 10.0.0.10" - could the traffic be "arriving" on a different NIC, or routed to some other IP - so something else in your network configuration?

Your rule is for em0 - where is that? In the bridge?
 
richardtoohey2 said:
Your rule is for traffic "to 10.0.0.10" - could the traffic be "arriving" on a different NIC, or routed to some other IP - so something else in your network configuration?
Click to expand...
Impossible I only have one NIC connected to a basic home router. And FreeBSD only configures the bridge and the em0 interfaces by dhcp. No extra configuration.
richardtoohey2 said:
Your rule is for em0 - where is that? In the bridge?
Click to expand...
Is the NIC connected to the router.
richardtoohey2 said:
You've enabled and started pflog, so I think if you add "log" to your block statement you should see what is being blocked by that rule.
Click to expand...
Still nothing.
 
Your `ifconfig` output appears to be incomplete, because em0 is a bridge member but it's not listed.
Secondly, you appear to have two interfaces in the same subnet, so how sure are you that traffic isn't arriving on re0?
Finally, you can't block traffic on em0 if it's actually arriving on bridge0 that em0 is a member of.

Disconnect re0 and use bridge0 in your pf rule.
 
Kristof Provost said:
Your `ifconfig` output appears to be incomplete, because em0 is a bridge member but it's not listed.
Secondly, you appear to have two interfaces in the same subnet, so how sure are you that traffic isn't arriving on re0?
Finally, you can't block traffic on em0 if it's actually arriving on bridge0 that em0 is a member of.

Disconnect re0 and use bridge0 in your pf rule.
Click to expand...
re0 is my real interface, which I was supposed to anonymize to em0 as in documentation.
 
Ferocious1881 said:
re0 is my real interface, which I was supposed to anonymize to em0 as in documentation.
Click to expand...
Do not lie when asking for help.

Also describe your jail configuration.

Right now your problem is that your physical interface has an ip address assigned and is a bridge member, in the same subnet.
Do not do this. Bridge member interfaces should not have addresses assigned. Fix that first. Then fix your pf rule to reflect the real interface receiving traffic, namely bridge0.
 
Guessing that you may be using vnet jails with traffic coming in via epair10, you need to explicitly allow traffic from the jail IP then. You cannot filter by interface if all traffic comes in on bridge0.
 
Kristof Provost said:
As opposed to vnet/vimage jails.

Describe your jail configuration.
Click to expand...
Here goes (with the internal network configuration gone):
Code: 
acme {
exec.start = "/bin/sh /etc/rc";
exec.consolelog = "/var/log/jail_console_${name}.log";

allow.mount;
allow.raw_sockets;
allow.vmm;
exec.clean;
mount.devfs;
securelevel = 2;
enforce_statfs = 2;
devfs_ruleset = 25;

path = "/jails/${name}";
host.hostname = "${name}";

vnet;
vnet.interface = "epair10b";

exec.prestart  = "/sbin/ifconfig epair10 create up";
exec.prestart += "/sbin/ifconfig epair10a up descr jail:${name}";
exec.prestart += "/sbin/ifconfig bridge0 addm epair10a up";
exec.prestart += "/sbin/ifconfig epair10a ether something:0a";
exec.prestart += "/sbin/ifconfig epair10b ether something:0b";
exec.start    += "/sbin/ifconfig epair10b 10.0.0.10/24 up";
exec.start    += "/sbin/route add default 192.168.1.1";

exec.stop     += "/bin/sh /etc/rc.shutdown jail";
exec.poststop = "/sbin/ifconfig bridge0 deletem epair10a";
exec.poststop += "/sbin/ifconfig epair10a destroy";
}
 
Kristof Provost said:
Guessing that you may be using vnet jails with traffic coming in via epair10, you need to explicitly allow traffic from the jail IP then. You cannot filter by interface if all traffic comes in on bridge0.
Click to expand...
Well, my rule is about blocking any coming from the NIC to the router, which points to by jail's ip:
Code: 
block drop quick on em0 from any to 10.0.0.10
 
With my pfctl -s rules now being:
Code: 
block drop log quick on bridge0 inet from any to 10.0.0.10
I am still able to connect to the vnc server from outside of the localhost.
 
You must log in or register to reply here.
Back
Top