• This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn more.

pf firewall

  1. DiscmanDaemon

    RPI3 B some issues with jails

    Hello all, I have been experimenting with running a project that works great on AMD64/X86 on an RPI3 B, and have had some hiccups with jails, and I am wondering if anyone has experienced anything similar, and has any idea as to the cause. I've noticed the standard method of NATting jails on a...
  2. T

    IPFW authpf alternative?

    I have a use case for authpf. However, I'd prefer to stick with IPFW as it seems to be more maintained and more recent than the included PF version. However, I've been unable to locate an alternate option that'll work with IPFW. Maybe I'm missing something, or maybe there's another way...
  3. D

    Router Troubleshooting

    Hello All, I am attempting to find out what my issue is with my FreeBSD Router that I am attempting to build. I have set up the following tools on my OS on my router: HostAPD DNSMasq PF All of which appear to work and I can route through the AP. However; I am not getting nearly the speeds or...
  4. dlegrand

    Solved IPv6 client first try

    Dear FreeBSD users, My first IPv6 try with my FreeBSD desktop machine was a bit disappointing. According to FreeBSD Handbook, I added two lines in my /etc/rc.conf: ifconfig_re0_ipv6="inet6 accept_rtadv" rtsold_enable="YES" I added into my fully functional /etc/pf.conf: icmp6_types = "{...
  5. K

    relayd with a source IP NAT?

    I'm attempting to use relayd to act as an extremely simple load-balancer between two machines, however all 3 machines are on entirely different public networks. However, it seems that relayd is just creating a rdr rule in pf, not a nat rule as well, so the packet is redirected but maintains...
  6. N

    PF seems not to be stateful in promiscuous mode

    While creating some VM's with Bhyve + IPv6 I had to create a bridge and therefore the main network card had to be in promiscuous] `promisc` mode. Eventually, I manage the VM's to work but start to notice a strange behavior (mainly timeouts and very slow responses) on the host while trying to...
  7. DD

    PF PF doesn't remove any states from the state table

    Hi all, I have the weirdest of the problems. I have a 10.4-release server with Nagios and a bunch of OpenVPN's on it and since I've upgraded to 10.4 from 10.3 after running peachy for a while it starts not removing the states from PF's state table, any state of any protocol. Being a Nagios...
  8. M

    PF PF & max-src-conn-rate

    I'm not sure if I am understanding the configuration correctly. pass in log on $EXT_IF inet proto tcp from any to $SERVER port $SSH \ flags S/SA keep state \ (max-src-conn-rate 3/6, overload <blacklist> flush global) I was under the impression that 3 connections within 6 seconds...
  9. DemoNIck

    propper routing and gateway configuration between 2 lan IPs

    There is a network topology which cannot be changed/altered as following: [FILESERVER]---192.168.254.1---->|======| [LANPC1]--------192.168.254.x---->| SWITCH |<--192.168.254.254--[MODEM]--->INTERNET [LANPC2]--------192.168.254.x---->|======| The FILESERVER (FreeBSD 11.1-RELEASE) is running...
  10. Farhan Khan

    PF pf Redirect from IPv4 to IPv6

    Hi all, I am trying to forward traffic from my IPv4 address on port 8000 to a jail's IPv6 address on the same port. Is that possible? My line in /etc/pf.conf is: rdr on vtnet0 proto tcp from any to [IPv4 Address] port 8000 -> [IPv6 Address] port 8000 This comes back with an unspecified syntax...
  11. N

    Openvpn up and down scripts for split tunnel and pf

    Hi All Im a linux user making the switch to freebsd, got everything set up except for one last thing Im trying to set up a split route with openvpn and the pf firewall I did read the freebsd manual and a couple of books about pf and googled before posting I have linux up and down scripts for...
  12. barrandrea

    PF Redirect all traffic from ip to another

    Hi, i need to redirect all traffic from a private ip address attested on a local interface, to a public ip address. The old configuration with iptables it's something like this iptables:-A PREROUTING -d $private_ip/32 -i $int_if -j DNAT --to-destination $public_ip iptables:-A PREROUTING ! -d...
  13. P

    PF How to delete one rule in PF ?

    Hello, From pfctl man page i know how to flush and disable/enable pf. But how can i remove from CLI only one rule, without full flushing and reload config file ? For example, i add on-the-fly command for port forwarding: echo 'rdr pass proto tcp from any to any port 37 -> 10.0.0.2' | pfctl -f...
  14. K

    PF Firewall in OpenVPN client mode can't do port forwarding

    I have a FreeBSD firewall/router using PF with OpenVPN configured as client mode so that all my traffic goes through the vpn connection via the vpn provider. When the OpenVPN connection is active on my firewall I can't get port forwarding to work properly on the internet facing interface, this...
  15. l33tname

    Solved Prosody s2s connection-timeout in jail

    I installed prosody in a jail redirect the traffic to it with pf. With this config: rdr on $EXT proto { tcp, udp } from any to any port $XMPP_PORTS -> 10.0.0.11 And for unknown reasons at least for me the s2s part just fails with error messages like this Sep 27 20:39:21 s2sin804074c40 info...
  16. D

    PF Anchor not working

    Hello all, I have an anchor for tagging packets based on their source IP origin country. For this I create a bunch of files inside /etc/firewall/tables/dynamic/ which contain the network prefixes for a certain country. For example, here is the output of head...
  17. I

    Solved NAT with forwarding is not working

    Hi guys! I've been a couple of days trying to set up a router in a virtual network using FreeBSD and I can't get it work I'm afraid. A quick summary of what I have and what I want to achieve: I have 2 interfaces: xn0, which is the external interface, and bridge0 which is internal. The...
  18. I

    PF Porting SYN cookies implementation to PF module of FreeBSD

    I've been using the PF module for NATing/firewalling purposes (8 cores, 16 GB RAM hardware), it seems to be doing good under normal traffic. But during TCP SYN floods it suffers a lot. I want the SYNPROXY feature to get enabled dynamically as the traffic increases for that particular rule (based...
  19. S

    PF Can PF be bypassed?

    Hi, Can anyone tell me if PF can be by-passed by an outsider(intruder)? I have an IP address that has already been in my ip.blocked table for two days and still its scans reach the web platform of the site where it is blocked by a firewall add-on/plugin at application level. Any help is welcome.
  20. S

    PF PF doesn't load at startup time in FreeBSD 10.1

    Hi, I have a problem with my PF it seems after all verification made with pfctl -vnf /etc/pf.conf NOT with the rulesets but number of tables and the size of it. Can be adjusted this situation? I can't control the size of tables for zones because are country based IP net blocks. So first I...
Top