Hi,
I am aware that this might be a stupid question, but I obviously lack some understanding here.
I am running a bhyve host (using vm-bhyve) with guests in different subnets. I have an internal interface (igb0) and a dmz interface (igb1) and i am using virtual switches (bridges vm-internal and vm-dmz) for my VMs with tap devices.
Without pf everything works as expected. Now I want to make sure that access from the dmz subnet via igb1 to my host is impossible. ssh is only listening on the internal IP, I just want to make sure everything is closed in case I forget something.
In pf.conf I tried using "set skip" on everything related to the VMs and leave firewalling to those VMs. So I put this in my pf.conf:
But what do I do with the physical interfaces? Pass all traffic from igb0 to vm-internal and from igb1 to vm-dmz? My VMs currently don't get any Network access when pf is enabled.
I am aware that this might be a stupid question, but I obviously lack some understanding here.
I am running a bhyve host (using vm-bhyve) with guests in different subnets. I have an internal interface (igb0) and a dmz interface (igb1) and i am using virtual switches (bridges vm-internal and vm-dmz) for my VMs with tap devices.
Without pf everything works as expected. Now I want to make sure that access from the dmz subnet via igb1 to my host is impossible. ssh is only listening on the internal IP, I just want to make sure everything is closed in case I forget something.
In pf.conf I tried using "set skip" on everything related to the VMs and leave firewalling to those VMs. So I put this in my pf.conf:
Code:
virt_if = "{ vm-dmz, vm-internal, tap0, tap1, tap2 }"
set skip on $virt_if
But what do I do with the physical interfaces? Pass all traffic from igb0 to vm-internal and from igb1 to vm-dmz? My VMs currently don't get any Network access when pf is enabled.