PF firewall

[Roland Smith]

On Fri, Dec 07, 2007 at 06:20:37AM -0600, ajtiM wrote:
> Hi!
> 
> I am a new FreeBSD 7.0 beta3 user and I have standalone computer connected to 
> the internet  (cable). I use both, console and KDE desktop. I tried to setup 
> PF firewall for the standalone computer but I have a problem with internal 
> messages (mail) which are blocked if firewall running.
> This is from /var/log/mail:
> "sm-msp-queue[15113]: lB493C1i007320: to=root, ctladdr=root (0/0), 
> delay=1+21:37:55, xdelay=00:00:00, mailer=relay, pri
> =2552408, relay=[127.0.0.1], dsn=4.0.0, stat=Deferred: Operation not 
> permitted"
> 
> My pf.conf looks like:
> 
> pass out  quick inet  from (sk0)  to any keep state  label "RULE 0 -- ACCEPT "
> block drop in quick inet all label "RULE 1 -- DROP "
> block drop out quick inet all label "RULE 1 -- DROP "
> block drop in quick inet all label "RULE 10000 -- DROP "
> block drop out quick inet all label "RULE 10000 -- DROP "

You're dropping all incoming traffic, also on the local interface!

Try adding:

set skip on lo

furthermore, your ruleset has duplicates, especially since you use the
quick keyword.

Below is a commented example a pf.conf for a workstation (mine :-)
-------------------- /etc/pf.conf ---------------------
# /etc/pf.conf

# Macros: define common values, so they can be referenced and changed easily.
ext_if = "rl0"
int_if = "rl1"

# Addresses that can't be routed externally. 
# See http://www.rfc-editor.org/rfc/rfc3330.txt
# (10.0.0.138 is my router, so it should be reachable!)
table <unroutable> const { 0.0.0.0/8, 10.0.0.0/8, !10.0.0.138, 127.0.0.0/8, \
169.254.0.0/16, 172.16.0.0/12, 192.0.2.0/24, 192.168.0.0/16, 240.0.0.0/4 }

# Options: tune the behavior of pf.
set optimization normal
set block-policy drop
set loginterface $ext_if
set skip on lo

# Normalization: reassemble fragments etc.
scrub in all

# Translate outgoing packets' source addresses (any protocol).
# In this case, any address but the gateway's external address is mapped.
# The sysctl net.inet.ip.forwarding should be set for this to work.
# Alternatively, set gateway_enable="YES" in /etc/rc.conf.
nat pass on $ext_if inet from $int_if:network to any -> $ext_if

# Filtering
antispoof quick for $int_if

# Nobody gets in from the outside!
block in log quick on $ext_if all label "inblock"
# Block packets to unroutable addresses
block out log quick on $ext_if from any to <unroutable> label "unroutable"
# Block by default.
block out log on $ext_if all label "outblock"

# Internal "network" is trusted.
pass in on $int_if all 
# Let outgoing traffic through, and keep state
# 'modulate state' only works with TCP!
pass out on $ext_if inet proto tcp all flags S/SA modulate state
pass out on $ext_if inet proto udp all keep state
# Let pings through.
pass out on $ext_if inet proto icmp all icmp-type 8 code 0 keep state

-------------------- /etc/pf.conf ---------------------

HTH,
Roland
-- 
R.F.Smith                                   http://www.xs4all.nl/~rsmith/
[plain text _non-HTML_ PGP/GnuPG encrypted/signed email much appreciated]
pgp: 1A2B 477F 9970 BA3C 2914  B7CE 1277 EFB0 C321 A725 (KeyID: C321A725)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20071207/bb7bba37/attachment.pgp