newbie to pf

[Niklas Saers]

Hi guys,

On 12/4/06, Daniel Bye <freebsd-questions at slightlystrange.org> wrote:
> From reading the excellent documentation at the OpenBSD site, I think
> you are missing a `pass' rule for your redirected traffic.

Yes, I was. I've substituted "rdr" for "rdr pass" that I believe
should work great for ssh, https and mysql.

> Remember that the filtering engine will
> see the redirected packets /after/ translation occurs, so take that
> into account if you write dedicated rules.

Thanks for the heads-up there, at the time I wrote this I didn't think
of that. Been doing much reading since then, and as you point out,
that's an excelent documentation.

> As for your ssh problem - this may be related to a DNS timeout.

It was indeed. :-)

The main problem turned out to be the ADSL router, not pf. The
forwarded data was not being forwarded correctly, but a flash update
and reconfig later the data are coming in fine and being forwarded
just fine.

What I'm wondering about now is: what weaknesses are there in my
setup? Is there anything I should be particularly aware of?

# macros
ext_if = "sis0"
int_if = "sis1"
bus_if = "sis2"
internal_net = "10.0.2.0/24"
business_net = "10.0.3.0/24"
soekris = "{ 10.0.0.4, 10.0.2.1, 10.0.3.1 }"

# tables
table <firewall> const { self }

# options
set block-policy drop
set state-policy if-bound
#set require-order yes
#set fingerprints "/etc/pf.os"
#set loginterface $ext_if

# scrub incoming packets
set skip on lo
scrub all reassemble tcp fragment reassemble

# redirection
rdr pass on $ext_if proto tcp from any to any port 22 -> 10.0.3.2
rdr pass on $ext_if proto tcp from any to any port 443 -> 10.0.3.2
rdr pass on $ext_if proto tcp from any to any port 3306 -> 10.0.3.2

# nat
nat on $ext_if from $internal_net to any -> ($ext_if)
nat on $ext_if from $business_net to any -> ($ext_if)
no nat on $ext_if from $internal_net to $business_net
no nat on $ext_if from $internal_net to $soekris

# setup a default deny policy
block drop log all

# pass traffic on the loopback interface in either direction
pass quick on lo0 all
pass quick on $int_if all
pass quick on $bus_if all

# outgoing dns, ntp
pass out quick on $ext_if inet proto udp from ($ext_if) to any port {
53, 123 } keep state

# outgoing from firewall
pass out log quick on $ext_if inet proto tcp from ($ext_if) to any
flags S/SA keep state
pass out log quick on $ext_if inet proto { udp, icmp } from ($ext_if)
to any keep state

# incoming active ftp-data (this is required for active ftp to work)
pass in log quick on $ext_if inet proto tcp from any port 20 to
($ext_if) port >= 1024 flags S/SA keep state

# incoming tcp and udp from the internal network to the internet
pass in log quick on $int_if inet proto tcp from $internal_net to
!<firewall> flags S/SA modulate state
pass in log quick on $int_if inet proto udp from $internal_net to
!<firewall> keep state
pass in log quick on $bus_if inet proto tcp from $business_net to
!<firewall> flags S/SA modulate state
pass in log quick on $bus_if inet proto udp from $business_net to
!<firewall> keep state


Cheers

   Nik