Trying to rdr the traffic for /usr/audio/teamspeak3 (every port in $services after 80) to 192.168.1.10 (kif)... I see the traffic pass into the firewall on my external interfact (em0), but get no traffic on kif using tcpdump and the connection always errors out...
Code:
root@gateway:/usr/home/tim.falardeau # tcpdump -n -e -ttt -q -i pflog0
tcpdump: WARNING: pflog0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 65535 bytes
00:00:00.000000 rule 0..16777216/0(match): block in on em0: 70.166.151.80.62407 > (exterior ip).63004: UDP, length 96
00:00:06.436085 rule 0..16777216/0(match): block in on em0: 10.1.240.1.67 > 255.255.255.255.68: UDP, length 365
00:00:02.005694 rule 0..16777216/0(match): block in on em0: 10.1.240.1.67 > 255.255.255.255.68: UDP, length 365
00:00:04.056724 rule 3..16777216/0(match): block in on em0: 123.151.42.61.9061 > (exterior ip).1701: UDP, length 107
00:00:04.689592 rule 10..16777216/0(match): pass in on em0: x.x.x.x.57845 > x.x.x.x.9987: UDP, length 34
00:00:16.183314 rule 0..16777216/0(match): block in on em0: (exterior ip).138 > 68.15.62.127.138: UDP, length 227
00:00:00.000024 rule 0..16777216/0(match): block in on em0: (exterior ip).138 > 68.15.62.127.138: UDP, length 208
^C
7 packets captured
7 packets received by filter
0 packets dropped by kernel
Code:
root@gateway:/usr/home/tim.falardeau # cat /root/firewall.d/pf.conf
############ Global Options #######################
ext_if="em0"
int_if="em1"
set block-policy return
set loginterface $ext_if
set skip on lo
set skip on $int_if
services="{ 80, 9987, 30033, 10011, 41144 } "
icmp_types="echoreq"
localnet="192.168.1.0/24"
ext_ip="x.x.x.x"
int_ip="192.168.1.1"
kif="192.168.1.10"
trusted_ips="{ x.x.x.x }"
table <us.blocks> persist file "/root/firewall.d/us.blocks"
table <aliens> persist file "/root/firewall.d/aliens.blocks"
table <bruteforce> persist file "/root/firewall.d/bruteforce"
table <trusted.ips> persist file "/root/firewall.d/trusted.ips"
table <authpf_users> persist
################ End Global Options ################
########### Traffic Normalization ##################
scrub in on $ext_if all fragment reassemble
scrub out on $ext_if all fragment reassemble
####################################################
####### NAT RULE GOES BEFORE ALL FILTERS ! ! #######
nat on $ext_if from $localnet to any -> ($ext_if)
####################################################
## REDIRECT RULES AFTER NAT AND BEFORE FILTERS !! ##
rdr on $ext_if inet proto tcp from any to $ext_ip port $services -> $kif
rdr-anchor "authpf/*" from <authpf_users>
####################################################
################## Filters #########################
block in log all
pass in quick on $ext_if inet proto tcp from $trusted_ips to any flags any
block drop log quick inet from <bruteforce>
block drop log quick on $ext_if inet from $localnet to <aliens>
block drop in log quick on $ext_if inet from <aliens> to $ext_ip
block drop in log quick on $ext_if inet from ! <us.blocks> to $ext_ip
pass in log quick on $ext_if inet proto tcp from any \
to { $ext_ip, $localnet } port 22 \
flags S/SA keep state \
(max-src-conn 5, max-src-conn-rate 3/9, \
overload <bruteforce> flush global)
pass in log on $ext_if inet proto {udp, tcp} from any to {self} port $services
pass out log on $ext_if inet proto {udp, tcp} from any to $localnet port $services
pass in log on $int_if inet proto {udp, tcp} from any to $localnet port $services
pass out log on $int_if inet proto {udp, tcp} from any to $localnet port $services
anchor "authpf/*" from <authpf_users>
####################################################
################### <END OF FILE> ##################
####################################################
Last edited:
