PF PF with DMZ - Can't ping from the Firewall/GW itself (AGAIN!)

Aknot

Aknot

I'm lost!

I have replaced my last configuration to use DMZ instead, and everything "seems" to be working, except one thing, I can't ping and resolv hostnames from the gateway itself.
I need to be able to update and install on the firewall/GW/Router itself, and that doesn't work right now.

I can ping IP addresses!
Pinging host names is giving me error: # ping google.com => ping: UDP connect: No route to host

This is what I have right now:

rc.conf

Code: 
## NETWORK
gateway_enable="YES"
defaultrouter="192.168.8.1" # Huawei 5G router as a test WAN connection, DHCP to if ale0.
ipv6_network_interfaces="none"
ip6addrctl_enable="NO"
dhcpd_enable="YES"
dhcpd_ifaces="igb0 igb1"

## WAN
ifconfig_ale0="DHCP"

## LAN 192.168.1.0/24
ifconfig_igb0="inet 192.168.1.1 netmask 255.255.255.0"

## DMZ 172.16.1.0/24
ifconfig_igb1="inet 172.16.1.1 netmask 255.255.255.0"

resolv.conf

Code: 
nameserver 1.1.1.1
nameserver 8.8.8.8
nameserver 8.8.4.4

fp.conf

Code: 
# =======================================================================
# 0. SETTINGS
# =======================================================================

# DHCP => Internet (WAN)
ext_if = "ale0"

# 192.168.1.0/24 => Home network
lan_if = "igb0"

# 172.16.1.0/24 => DMZ network
dmz_if = "igb1"

lan_net = $lan_if:network
dmz_net = $dmz_if:network

# Web server IP address in DMZ subnet
#web_server = "172.16.1.50"

# Test on HP Pavilion laptop
web_server = "172.16.1.120"

# Ports allowed to the web server (HTTP and HTTPS)
web_ports = "{80,443}"

# =========================================================================
# 1. TABLES & OPTIONS
# =========================================================================
set skip on lo0 # Ignore local traffic (loopback)

# =========================================================================
# 2. NAT & PORT FORWARDING (Address translations)
# =========================================================================

# Share Internet access to both the home network and DMZ (NAT)
nat on $ext_if from $lan_net to any -> ($ext_if)
nat on $ext_if from $dmz_net to any -> ($ext_if)

# NAT rule for DMZ out on WAN
nat on $ext_if from $dmz_if:network to any -> ($ext_if)

# =========================================================================
# 3. REDIRECTS
# =========================================================================

# Redirect incoming traffic from Internet to the web server on ports 80 and 443
rdr on $ext_if inet proto tcp from any to ($ext_if) port $web_ports -> $web_server

# Redirect incoming traffic on WAN port 25200 to web server port 25200 in DMZ
rdr on $ext_if proto tcp from any to ($ext_if) port 25200 -> $web_server port 25200

# =========================================================================
# 4. FIREWALL RULES (FILTERING)
# =========================================================================

# Start by block all
block all

# Allow DHCP (UDP on port 67/68) on both LAN and DMZ
pass in quick on $lan_if proto udp from any port 68 to any port 67
pass in quick on $dmz_if proto udp from any port 68 to any port 67

# Allow ping for DNS from the firewall on WAN
pass out quick on $ext_if proto { udp, tcp } to any port 53 keep state

# Allow ping with external DNS (e.g. 1.1.1.1)
pass in quick on $lan_if proto { udp, tcp } from $lan_if:network to any port 53 keep state

# Allow SSH to the Firewall on port 25200 from Internet
pass in quick on $ext_if proto tcp from any to ($ext_if) port 25200 synproxy state

# Allow SSH to the Firewall on port 25200 from LAN
pass in quick on $lan_if proto tcp from $lan_if:network to 192.168.1.1 port 25200 keep state

# Allow SSH to the web server on port 25200 from DMZ
pass in quick on $ext_if proto tcp from any to $web_server port 25200 synproxy state

# Allow SSH to the web server on port 25200 from LAN
pass in quick on $lan_if proto tcp from $lan_if:network to $web_server port 25200 keep state

# Block all traffic from DMZ to LAN
block in quick on $dmz_if to $lan_net

# Block DMZ to reach the FreeBSD-routers own internal IP addresses
block in quick on $dmz_if to ($lan_if)

# Allow outgoing traffic to the Internet from the FreeBSD-router
pass out on $ext_if proto { tcp, udp, icmp } all

# Allow incoming traffic from WAN (Internet) to the web server
pass in quick on $ext_if proto tcp to $web_server port $web_ports

# Allow LAN to the router, Internet and DMZ
pass in on $lan_if from $lan_net to any
pass out on $lan_if to $lan_net

# Allow the web server to Internet, but not to the LAN
pass in on $dmz_if from $dmz_net to any
pass out on $dmz_if to $dmz_net

# Allow the DMZ to reach the Internet (everything except LAN)
pass in quick on $dmz_if proto { tcp, udp, icmp } from $dmz_if:network to ! $lan_if:network keep state

Thanks,
 
" Pinging host names is giving me error: # ping google.com => ping: UDP connect: No route to host "

As the err msg says UDP and not ICMP , its a name lookup issue with DNS probably.

Ping utility cant convert hostname to IP-address. How is the Gateway Machine's DNS resolution configured ?
 
The host itself isn't allowed to query DNS. Don't set defaultrouter if you use DHCP on ale0.
 
You must log in or register to reply here.
Back
Top