Another problem with pf..

[Matteo Riondato]

Il Gio, 2004-10-21 alle 21:13, Dimitry Andric ha scritto:
> On 2004-10-21 at 20:29:48 Matteo Riondato wrote:
> 
> > pf_enable="YES"
> > pf_rules="/etc/pf.conf"
> 
> The last line is not really needed, as it is the default anyway (see
> /etc/defaults/rc.conf).

With or without that line, the situation does not change.



>   pfctl -n -v -f /etc/pf.conf
kaiser# pfctl -n -v -f /etc/pf.conf
ext_if = "tun0"
wifi_if = "rl0"
eth_if = "fxp1"
wifi_net = "192.168.1.0/27"
eth_net = "192.168.0.0/29"
tcp_services = "{ 22, 80, 25, 4660 >< 4683, 6890 >< 6901 }"
icmp_types = "{ 0, 3, 8, 11 }"
scrub in all fragment reassemble
block drop all
pass quick on lo0 all
block drop in log quick on ! rl0 inet from 192.168.1.0/24 to any
block drop in log quick inet from 192.168.1.1 to any
block drop in quick on ! fxp1 inet from 192.168.0.0/24 to any
block drop in quick inet from 192.168.0.1 to any
pass in on tun0 inet proto tcp from any to 82.52.115.76 port = ssh flags
S
/SA keep state
pass in on tun0 inet proto tcp from any to 82.52.115.76 port = http
flags 
S/SA keep state
pass in on tun0 inet proto tcp from any to 82.52.115.76 port = smtp
flags 
S/SA keep state
pass in on tun0 inet proto tcp from any to 82.52.115.76 port 4660 ><
4683 
flags S/SA keep state
pass in on tun0 inet proto tcp from any to 82.52.115.76 port 6890 ><
6901 
flags S/SA keep state
pass inet proto icmp all icmp-type echorep
pass inet proto icmp all icmp-type unreach
pass inet proto icmp all icmp-type echoreq
pass inet proto icmp all icmp-type timex
pass in on rl0 inet from 192.168.1.0/27 to any keep state
pass out on rl0 inet from any to 192.168.1.0/27 keep state
pass in on fxp1 inet from 192.168.0.0/29 to any keep state
pass out on fxp1 inet from any to 192.168.0.0/29 keep state
pass in on rl0 inet from 192.168.1.200 to 192.168.1.1 keep state
pass out on rl0 inet from 192.168.1.1 to 192.168.1.200 keep state
pass out on tun0 proto tcp all flags S/SA modulate state
pass out on tun0 proto udp all keep state
pass out on tun0 proto icmp all keep state
kaiser#
-- 
Rionda aka Matteo Riondato
GUFI Staff Member (http://www.gufi.org)
FreeSBIE Developer (http://www.freesbie.org)
BSD-FAQ-it Main Developer (http://utenti.gufi.org/~rionda)
Sent from: kaiser.sig11.org running FreeBSD-6.0-CURRENT
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: Questa parte del messaggio =?ISO-8859-1?Q?=E8?= firmata
Url : http://lists.freebsd.org/pipermail/freebsd-pf/attachments/20041021/5cc44b61/attachment.bin