PF Routing to VPN Device

Tim Judd tajudd at gmail.com
Thu Jun 18 18:38:26 UTC 2009


On 6/17/09, Mike Sweetser - Adhost <mikesw at adhost.com> wrote:
> Hello,
>
> We have a network with a VPN device sitting beside a PF server, both
> connected to an internal network.
>
> PF Server: 10.1.4.1
> VPN Device: 10.1.4.200
>
> The VPNs are set up for 10.1.1.0/24 and 10.1.2.0/24, so any traffic to
> these networks should be routed to 10.1.4.200.  We've set up routes on
> the PF server as such.
>
> We've set up the following rules:
>
> block in log
> pass in on $int_if route-to 10.1.4.200 from 10.1.4.0/24 to { 10.1.1.0/24
> 10.1.2.0/24)
>
> However, the block in log is catching the return traffic.  From pflog
> when somebody on the VPN (10.1.2.105) tries to connect to 10.1.4.25 on
> port 80:
>
> 000000 rule 28/0(match): block in on bge1: 10.1.4.25.80 >
> 10.1.2.105.3558: [|tcp]
>
> If we remove the block in log, the traffic works.
>
> What are we missing?
>
> Thanks,
> Mike



Mike,

I know the typical firewall rules that are googleable are one of two
basic starting policies..

-- 1.
  block in all
  pass out all


-- 2.
  block all



They've become a headache to me to configure a firewall and I now
start with this base.  In this example, fxp0 is facing the Internet,
and xl0 is facing the trusted network.

-- 3.
  block in on fxp0 all
  pass out

This adds the benefit that VPN connections, TUNs, GIFs, and all other
ethernet devices aren't blindly evaluated to a simple block in rule,
rather it's just the fxp0 interface public Internet traffic that is
being blocked, while TUNs, GIFs, and the like are exempt from that
rule entry line.



Might you try by editing your rules to just block your public IP
firewall interface?



Good luck.


More information about the freebsd-questions mailing list