pflog and traffic via gif_if
dinzdale at gmail.com
Thu Apr 14 00:47:08 PDT 2005
On 4/13/05, Vlad GALU <vladgalu at gmail.com> wrote:
> On 4/13/05, stephen <dinzdale at gmail.com> wrote:
> > On 4/13/05, Vlad GALU <vladgalu at gmail.com> wrote:
> > > On 4/13/05, stephen <dinzdale at gmail.com> wrote:
> > > You're not allowing any ipencap traffic on your tun interface. One
> > > more thing: you have "block in on $ext_if all" twice.
> > >
> > Ah yeah... I do have it correct in my pf.conf, it was because i was
> > replacing all the variables back to what they should be.. must've lost
> > concentration as I was sending this mail just as my ride home arrived.
> > Can you tell me more about allowing ipencap please?
> gif interfaces use an encapsulation named "ipencap" (grep ipencap
> /etc/protocols, you'll see it mentioned there). All you have to do is
> to permit that type of protocol to flow in and out your tun interface.
> this should do it.
ok, we're making progress!
I added the rules:
pass in on $ext_if inet proto ipencap from any to any keep state
pass out on $ext_if inet proto ipencap from any to any keep state
I dont think I'd need the keep state as I'm passing all in and out,
but through it in there anyway..
Thu Apr 14 09:37:23 root at bollox:/home/stephen# ping -c 3 10.0.89.254
PING 10.0.89.254 (10.0.89.254): 56 data bytes
--- 10.0.89.254 ping statistics ---
3 packets transmitted, 0 packets received, 100% packet loss
Thu Apr 14 09:37:47 root at bollox:/home/stephen# ping -c 3 www.iol.co.za
PING www.iol.co.za (184.108.40.206): 56 data bytes
64 bytes from 220.127.116.11: icmp_seq=0 ttl=58 time=48.192 ms
64 bytes from 18.104.22.168: icmp_seq=1 ttl=58 time=46.719 ms
64 bytes from 22.214.171.124: icmp_seq=2 ttl=58 time=49.637 ms
--- www.iol.co.za ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max/stddev = 46.719/48.183/49.637/1.191 ms
I've now gone from 'operation not permitted' to no ping response when
pinging 10.0.89.254 (end point of tunnel). doesn't look like an icmp
issue as I can ping www.iol.co.za via tun0 w/o a problem.
perhaps I should stop looking at this problem and try rectify my pflog
problem as I'm sure it'll help tell me what to look at rather than
posting step by step =] (although I'm helping one day this'll help
someone else cause had me baffled for a while and couldnt find
anything on the web)
Thanks for help thus far =]
More information about the freebsd-pf