In order to minimize damage on my production server, I have built a virtual testbed (production is FreeBSD 8.0 testbed as it says next is FreeBSD 8.3)
I am running FreeBSD 8.3 under Virtualbox on a Mac OSX box (host) on an intranet 10.0.1.x. The host has an IP of 10.0.1.118. The guestfreeBSD FreeBSD server has an IP of 10.0.1.195. The network router is at 10.0.1.1 with an internet address of a.b.c.d.
I have an OpenVPN server, which appears to be functioning well with a working tunnel with VPNnet of 10.9.0.0/24. The network interface for the guest server is em1.
My issue is that with pf enabled I can
Results of
I would assume my problem is shown in the last block drop.
Two questions:
I am running FreeBSD 8.3 under Virtualbox on a Mac OSX box (host) on an intranet 10.0.1.x. The host has an IP of 10.0.1.118. The guest
I have an OpenVPN server, which appears to be functioning well with a working tunnel with VPNnet of 10.9.0.0/24. The network interface for the guest server is em1.
My issue is that with pf enabled I can
ping but not ssh from the host to the guest on the intranet but I can both ping and ssh via the VPN. My current pf.conf is as follows:
Code:
tcp_pass = "{ 20 21 22 25 53 80 81 8010 110 137 138 139 443 445 465 587 993}"
udp_pass = "{ 137 138 139 465 587 1194}"
# --- SCRUB section ---
scrub in all
# --- NAT rules -------------
nat pass on em1 from 10.9.0.0/24 to any -> 10.0.1.195
pass in quick proto {tcp,udp} to 10.0.1.195 port 1194
pass in quick from 10.9.0.0/24 to any # I do have block in
# ------------------ FILTER RULES -------------------
# --- OUTGOING
pass out quick on em1 inet proto tcp to any port $tcp_pass
pass out quick on em1 inet proto udp to any port $udp_pass
pass out quick on em1 inet from any to any keep state
pass out quick from 10.0.1.195 to 10.0.1.0/24
# --- INCOMING
pass in quick on em1 inet proto udp to any port $udp_pass
pass in quick on em1 inet proto tcp to any port $tcp_pass
pass in quick from 10.0.1.0/24 to 10.0.1.195
# --- pass incoming openvpn connections to the internal openvpn server ---
#pass in quick on em1 inet proto { tcp udp } from any to 10.9.0.2
# --- antispoof protection ---
antispoof quick for em1 inet
# --- default policy
#block log all
# --- end of pf rule setResults of
pfctl-sr
Code:
pass out quick on em1 inet proto udp from any to any port = netbios-ns keep state
pass out quick on em1 inet proto udp from any to any port = netbios-dgm keep state
pass out quick on em1 inet proto udp from any to any port = netbios-ssn keep state
pass out quick on em1 inet proto udp from any to any port = smtps keep state
pass out quick on em1 inet proto udp from any to any port = submission keep state
pass out quick on em1 inet proto udp from any to any port = openvpn keep state
pass out quick on em1 inet all flags S/SA keep state
pass out quick inet from 10.0.1.195 to 10.0.1.0/24 flags S/SA keep state
pass in quick on em1 inet proto udp from any to any port = netbios-ns keep state
pass in quick on em1 inet proto udp from any to any port = netbios-dgm keep state
pass in quick on em1 inet proto udp from any to any port = netbios-ssn keep state
pass in quick on em1 inet proto udp from any to any port = smtps keep state
pass in quick on em1 inet proto udp from any to any port = submission keep state
pass in quick on em1 inet proto udp from any to any port = openvpn keep state
pass in quick on em1 inet proto tcp from any to any port = ftp-data flags S/SA keep state
pass in quick on em1 inet proto tcp from any to any port = ftp flags S/SA keep state
pass in quick on em1 inet proto tcp from any to any port = ssh flags S/SA keep state
pass in quick on em1 inet proto tcp from any to any port = smtp flags S/SA keep state
pass in quick on em1 inet proto tcp from any to any port = domain flags S/SA keep state
pass in quick on em1 inet proto tcp from any to any port = http flags S/SA keep state
pass in quick on em1 inet proto tcp from any to any port = hosts2-ns flags S/SA keep state
pass in quick on em1 inet proto tcp from any to any port = 8010 flags S/SA keep state
pass in quick on em1 inet proto tcp from any to any port = pop3 flags S/SA keep state
pass in quick on em1 inet proto tcp from any to any port = netbios-ns flags S/SA keep state
pass in quick on em1 inet proto tcp from any to any port = netbios-dgm flags S/SA keep state
pass in quick on em1 inet proto tcp from any to any port = netbios-ssn flags S/SA keep state
pass in quick on em1 inet proto tcp from any to any port = https flags S/SA keep state
pass in quick on em1 inet proto tcp from any to any port = microsoft-ds flags S/SA keep state
pass in quick on em1 inet proto tcp from any to any port = smtps flags S/SA keep state
pass in quick on em1 inet proto tcp from any to any port = submission flags S/SA keep state
pass in quick on em1 inet proto tcp from any to any port = imaps flags S/SA keep state
pass in quick inet from 10.0.1.0/24 to 10.0.1.195 flags S/SA keep state
block drop in quick on ! em1 inet from 10.0.0.0/8 to any
block drop in quick inet from 10.0.1.195 to anyI would assume my problem is shown in the last block drop.
Two questions:
- If this is in fact the issue, any suggestion on how to correct?
- In some of the guides I have read there is reference to a /etc/nat.conf. Should I have one?