Solved BVCP and pf rules

[Otis B. Driftwood]

I can access the BVCP web interface on my FreeBSD workstation when I have the PF firewall disabled, but whenever I have PF firewall enabled and try to connect to a BVCP web interface, I get the following error: "Unable to connect to Backend module".

I would expect it to work if I open inbound port 443 for https and port 8086 for BVCP in my pf.conf, but something else needs to be configured, as well, to get it working. Does anyone have any idea what I need to fix in this pf.conf to allow access to the backend module?

ext_if = "em0"
local_net = "192.168.50.0/24"
block all
pass in proto { tcp udp } to port { 80 443 8080 8086 41805 }
pass out proto { tcp udp } to port { 22 43 53 80 123 137 139 443 445 110 143 853 993 1194 8080 8086 41805 }
pass out inet proto icmp icmp-type { echoreq }
pass in inet proto icmp icmp-type { echoreq }
pass in on $ext_if proto tcp from any to any keep state
## Allow outbound OpenVPN traffic
pass out on $ext_if proto { tcp udp } from $local_net to any port { 443 1194 }
## Optional: Allow inbound OpenVPN traffic (only if needed)
# pass in on $ext_if proto { tcp udp } from any to $local_net port { 443 1194 }

 

[SirDice]

I presume there's a webserver (apache, nginx?) frontend running on 80/443 and it proxies the connection to the BVCP backend application on port 8086? I don't know BVCP but this is a common way of configuring web applications. Then you do not need to allow external access to port 8086, only 80/443. The frontend proxies to 'localhost' however, so you will likely need a set skip on lo, you're missing that one.

I would suggest removing ports 137 and 139 from the outgoing rule, those are the old NetBIOS ports for SMB/CIFS, modern Windows versions only use TCP port 445.

 

[Otis B. Driftwood]

Yes, there is an Apache server running. My plan is to move all web server stuff to virtual machines, so there will be no need to host web servers on this workstation.

I tried set skip on lo and it fixed the problem. Thanks a lot!

I'll also remove those ports from outbound. Thanks for the tip.