Hi,
It seems I'm still struggling to fully grasp the concept behind pf filtering rules. I got the following setup:
A router/gateway which has five active interfaces, one (tun0) facing the WAN, the others (igb1, lagg0.64, lagg0.128, lagg.192) facing the LAN. What I want to achieve is to limit the traffic between the different networks, for instance I would like to restrict ICMP, like in the following table:
If I do so, I successfully can't reach any of the devices in the 192.168.101.192/26 network from 192.168.101.0/26 except for the router interface 192.168.101.193/26 which is still responding to ICMP echo-request, but I don't understand why.
I hope someone can point out my mistake here.
It seems I'm still struggling to fully grasp the concept behind pf filtering rules. I got the following setup:
A router/gateway which has five active interfaces, one (tun0) facing the WAN, the others (igb1, lagg0.64, lagg0.128, lagg.192) facing the LAN. What I want to achieve is to limit the traffic between the different networks, for instance I would like to restrict ICMP, like in the following table:
| from | to | state |
| 192.168.101.64/26 | 192.168.101.192/26 | PASS |
| 192.168.101.192/26 | 192.168.101.192/26 | PASS |
| 192.168.101.0/26 | 192.168.101.192/26 | BLOCK |
If I do so, I successfully can't reach any of the devices in the 192.168.101.192/26 network from 192.168.101.0/26 except for the router interface 192.168.101.193/26 which is still responding to ICMP echo-request, but I don't understand why.
I hope someone can point out my mistake here.- router/gateway using freebsd 13.0-RELEASE-p5
- interfaces:
- tun0 - WAN interface
- igb1 - 192.168.101.1/26 desc W
- lagg0.64 192.168.101.65/26 vlan desc O
- lagg0.128 192.168.101.129/26 vlan desc S
- lagg0.192 192.168.101.193/26 vlan desc M
- interfaces:
Code:
# /usr/local/etc/pf.conf
#
#-----------------------------------------------------------------------------
#
# Options
#
#-----------------------------------------------------------------------------
#
# iface: WAN
ifWan = "tun0"
#
# iface: VLAN
ifW = "igb1"
ifO = "lagg0.64"
ifS = "lagg0.128"
ifM = "lagg0.192"
# Variable declaration
include "/usr/local/etc/pf.conf.d/var/vlanWAN.conf"
# disable packet filtering on loopback interface
set skip on { lo }
#-----------------------------------------------------------------------------
#
# Normalization
#
#-----------------------------------------------------------------------------
# enable normalization of all incoming packets on all interfaces
scrub in all fragment reassemble max-mss 1440
#-----------------------------------------------------------------------------
#
# Queueing
#
#-----------------------------------------------------------------------------
#
# nothing here
#
#-----------------------------------------------------------------------------
#
# Translation (NAT)
#
#
#-----------------------------------------------------------------------------
include "/usr/local/etc/pf.conf.d/nat/vlanM.conf"
include "/usr/local/etc/pf.conf.d/nat/vlanS.conf"
include "/usr/local/etc/pf.conf.d/nat/vlanW.conf"
include "/usr/local/etc/pf.conf.d/nat/vlanO.conf"
#-----------------------------------------------------------------------------
#
# Filtering
#
#-----------------------------------------------------------------------------
# antispoof support
antispoof quick for { lo $ifWan $ifW $ifO $ifS $ifM }
# 1st rule
block all
#-----------------------------------------------------------------------------
#
# Inbound
#
#-----------------------------------------------------------------------------
# VLan: WAN (Internet)
include "/usr/local/etc/pf.conf.d/inbound/vlanWAN.conf"
# VLan: M
include "/usr/local/etc/pf.conf.d/inbound/vlanM.conf"
# VLan: S
include "/usr/local/etc/pf.conf.d/inbound/vlanS.conf"
# VLan: W
include "/usr/local/etc/pf.conf.d/inbound/vlanW.conf"
# VLan: O
include "/usr/local/etc/pf.conf.d/inbound/vlanO.conf"
#-----------------------------------------------------------------------------
#
# Outbound
#
#-----------------------------------------------------------------------------
# VLan: WAN (Internet)
include "/usr/local/etc/pf.conf.d/outbound/vlanWAN.conf"
# VLan: M
include "/usr/local/etc/pf.conf.d/outbound/vlanM.conf"
# VLan: S
include "/usr/local/etc/pf.conf.d/outbound/vlanS.conf"
# VLan: W
include "/usr/local/etc/pf.conf.d/outbound/vlanW.conf"
# VLan: O
include "/usr/local/etc/pf.conf.d/outbound/vlanO.conf"
Code:
#
# /etc/pf.conf.d/inbound/vlanW.conf
#
# interface var: $ifW
# ICMP: echoreq, unreach
pass in on $ifW inet proto icmp icmp-type { echoreq, unreach }
Code:
#
# /etc/pf.conf.d/outbound/vlanM.conf
#
# interface var: $ifM
# $ifW
# ICMP: echoreq, unreach
pass out on $ifM inet proto icmp from { $ifM:network $ifO:network } icmp-type { echoreq, unreach }
