Hi, everyone. Seems like between the times I DO the PF config, I forget something very important ![Smile :) :)](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Anyway. My box has 3 NICs. There is WAN and LAN ethernets, then there is a WIFI AP managed by hostapd. And here is my /etc/pf.conf:
A very simple one, I simplified it on purpose. So is there anything wrong with it?
Notice, I purposefully created equal rules for all interfaces except the WAN ($out_if). There isn't a SINGLE rule for $lan_if that doesn't exist for $wifi_if.
Then how can it be that I can ping hosts connected to Wifi from LAN, but I can't ping LAN from any Wifi connected host?
I can also ping the $out_if interface address (and Internet in general, of course) from my WLAN computer. It is only LAN interface and network that cannot be pinged!
What can be the possible reason? Does WLAN behave in some way differently from LAN?
Actually, I originally wanted it to be exactly this way: wifi clients can connect but can't access LAN. While LAN clients can access everything. But yesterday I just couldn't make it by ANY means possible. WLAN connected client had immediate access to LAN. Now today I change a little something in there, and OH I can't make it work again this way
)))))))
So maybe this is the behaviour I wanted. But now I want to know WHY. It seems terribly weird to me. And this is not the first PF firewall that I'm managing.
Anyway. My box has 3 NICs. There is WAN and LAN ethernets, then there is a WIFI AP managed by hostapd. And here is my /etc/pf.conf:
Code:
out_if = "igb0"
lan_if = "igb1"
wifi_if = "wlan0"
nonroute = "{ 0.0.0.0/8, 20.20.20.0/24, 127.0.0.0/8, 172.16.0.0/12, 169.254.0.0/16, 192.0
.2.0/24, 192.168.0.0/16, 224.0.0.0/3, 255.255.255.255 }"
icmp_types = "{ 0, 3, 8, 11, 12 }"
set optimization aggressive
set block-policy return
set skip on lo0
scrub in all fragment reassemble no-df max-mss 1440
nat on $wifi_if from ! $wifi_if:network to any -> ($wifi_if)
nat on $lan_if from ! $lan_if:network to any -> ($lan_if)
nat on $out_if from ! $out_if:network to any -> ($out_if)
anchor openvpn
anchor openvpn_server1
antispoof quick for { $out_if $lan_if $wifi_if }
block drop in quick on $out_if from $nonroute to any
block in on $out_if all
pass quick on $wifi_if all
pass quick on $lan_if all
pass in quick on $out_if inet proto icmp all icmp-type $icmp_types
pass out quick all
block all
Notice, I purposefully created equal rules for all interfaces except the WAN ($out_if). There isn't a SINGLE rule for $lan_if that doesn't exist for $wifi_if.
Then how can it be that I can ping hosts connected to Wifi from LAN, but I can't ping LAN from any Wifi connected host?
I can also ping the $out_if interface address (and Internet in general, of course) from my WLAN computer. It is only LAN interface and network that cannot be pinged!
What can be the possible reason? Does WLAN behave in some way differently from LAN?
Actually, I originally wanted it to be exactly this way: wifi clients can connect but can't access LAN. While LAN clients can access everything. But yesterday I just couldn't make it by ANY means possible. WLAN connected client had immediate access to LAN. Now today I change a little something in there, and OH I can't make it work again this way
So maybe this is the behaviour I wanted. But now I want to know WHY. It seems terribly weird to me. And this is not the first PF firewall that I'm managing.