Hello,
I've read a number of other threads and resources (here and elsewhere) but I can't seem to get the correct combination of things to make my scenario work. Some info seems to be outdated or I'm not sure how to fit it in. Maybe it just isn't possible. Hopefully this isn't completely duplicated with another post, but here we go...
I'm trying to configure a device that I have to act as a transparent filtering bridge and transparent outbound web proxy. I've gotten the bridge working, but haven't been able to get the forwarding to work to send web requests (http and https) to squid. I've tried all sorts of combinations of rdr, route-to and filter lines I don't really know how it's even working at all at this point. The bridge does work and filter, but nothing gets routed to squid on port 3128. The device has three interfaces and I'm using two. igb1 is connected to a switch which is connected to my PC, and igb0 is connected to my Internet router.
I have a Node web app that I made (running on port 3000) which manages pf address tables. I don't think this is interfering or preventing the squid redirection, but anything is possible. The rules from that are included.
Any help figuring this out would be appreciated. I prefer pf, but if that's a problem for doing this on FreeBSD, I could switch to something else. I could also swap out squid for something else. I don't really want to swap out FreeBSD for something else, though.
I've read a number of other threads and resources (here and elsewhere) but I can't seem to get the correct combination of things to make my scenario work. Some info seems to be outdated or I'm not sure how to fit it in. Maybe it just isn't possible. Hopefully this isn't completely duplicated with another post, but here we go...
I'm trying to configure a device that I have to act as a transparent filtering bridge and transparent outbound web proxy. I've gotten the bridge working, but haven't been able to get the forwarding to work to send web requests (http and https) to squid. I've tried all sorts of combinations of rdr, route-to and filter lines I don't really know how it's even working at all at this point. The bridge does work and filter, but nothing gets routed to squid on port 3128. The device has three interfaces and I'm using two. igb1 is connected to a switch which is connected to my PC, and igb0 is connected to my Internet router.
I have a Node web app that I made (running on port 3000) which manages pf address tables. I don't think this is interfering or preventing the squid redirection, but anything is possible. The rules from that are included.
Any help figuring this out would be appreciated. I prefer pf, but if that's a problem for doing this on FreeBSD, I could switch to something else. I could also swap out squid for something else. I don't really want to swap out FreeBSD for something else, though.
Code:
# uname -a
FreeBSD sentinel 12.1-RELEASE-p6 FreeBSD 12.1-RELEASE-p6 GENERIC amd64
#
# sysctl net.link.bridge
net.link.bridge.ipfw: 0
net.link.bridge.allow_llz_overlap: 0
net.link.bridge.inherit_mac: 0
net.link.bridge.log_stp: 0
net.link.bridge.pfil_local_phys: 0
net.link.bridge.pfil_member: 0
net.link.bridge.ipfw_arp: 0
net.link.bridge.pfil_bridge: 1
net.link.bridge.pfil_onlyip: 1
#
# grep -vE '^(#|$)' /etc/pf.conf
set skip on lo0
pass in quick proto tcp from any to any port { 22, 3000 } keep state
pass quick on bridge0 inet from 192.168.254.0/24 to 192.168.254.0/24
pass quick on bridge0 inet proto tcp from any to any port { 80, 443 } keep state
include "/usr/local/etc/sentio/pf.conf"
block drop log all label "default-deny"
#
# grep -vE '^(#|$)' /etc/pf.conf
set skip on lo0
pass in quick proto tcp from any to any port { 22, 3000 } keep state
pass quick on bridge0 inet from 192.168.254.0/24 to 192.168.254.0/24
pass quick on bridge0 inet proto tcp from any to any port { 80, 443 } keep state
include "/usr/local/etc/sentio/pf.conf"
block drop log all label "default-deny"
#
# pfctl -s rules
pass quick on bridge0 inet proto tcp from any to any port = http flags S/SA keep state
pass quick on bridge0 inet proto tcp from any to any port = https flags S/SA keep state
pass in quick proto tcp from any to any port = ssh flags S/SA keep state
pass in quick proto tcp from any to any port = 3000 flags S/SA keep state
pass quick on bridge0 inet from 192.168.254.0/24 to 192.168.254.0/24 flags S/SA keep state
block drop quick on bridge0 inet proto udp from any to any port = 1900
pass quick on bridge0 inet proto udp from any to <allow-dst-udp-123> port = ntp keep state
pass quick on bridge0 inet proto udp from any to <allow-dst-udp-53> port = domain keep state
pass quick on bridge0 inet proto udp from any to <allow-dst-udp-5998> port = 5998 keep state
pass quick on bridge0 inet proto udp from any to <allow-dst-udp-any> keep state
pass quick on bridge0 inet proto igmp from any to <allow-dst-igmp-any> keep state
block drop log all label "default-deny"
#
# ifconfig
igb0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=e527bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,TSO6,LRO,WOL_MAGIC,VLAN_HWFILTER,VLAN_HWTSO,RXCSUM_IPV6,TXCSUM_IPV6>
ether 00:0d:b9:43:44:c8
media: Ethernet autoselect
status: no carrier
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
igb1: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=e523bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,TSO6,WOL_MAGIC,VLAN_HWFILTER,VLAN_HWTSO,RXCSUM_IPV6,TXCSUM_IPV6>
ether 00:0d:b9:43:44:c9
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
igb2: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=e523bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,TSO6,WOL_MAGIC,VLAN_HWFILTER,VLAN_HWTSO,RXCSUM_IPV6,TXCSUM_IPV6>
ether 00:0d:b9:43:44:ca
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4
inet 127.0.0.1 netmask 0xff000000
groups: lo
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
ether 02:94:57:4d:bb:00
inet 192.168.254.65 netmask 0xffffff00 broadcast 192.168.254.255
id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
member: igb2 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
ifmaxaddr 0 port 3 priority 128 path cost 2000000
member: igb1 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
ifmaxaddr 0 port 2 priority 128 path cost 2000000
groups: bridge
nd6 options=9<PERFORMNUD,IFDISABLED>
pflog0: flags=141<UP,RUNNING,PROMISC> metric 0 mtu 33160
groups: pflog