Hi,
For kicks, can you remove (or add the log keyword to):
block drop in quick on $ext_if from $private_networks to any
block drop out quick on $ext_if from any to $private_networks
and see if you get anything on the pflog interface then?
Does tcpdump on $int_if show any of the udp packets (Should if they
arent showing up on the log interface, right?)
Could you include the output from pfctl -s rules?
-Ian
On Wed, 23 Mar 2005 08:52:43 +0800, F Walls <fwalls@linuxmail.org> wrote:
Thanks Rafael, but no luck.
tcpdump -nettti pflog0 doesn't show any of the UDP ports that we are using
getting blocked.
I tried with your suggestions:
pass in on $ext_if from any to $udpserver port 6666:7000 keep state
and alternatively:
pass in on $int_if from $udpserver to any port 6666:7000
and no luck, here is the broken ruleset as it stands, anybody else have any
ideas?
#-------
# Macros
#-------
Content not important
scrub in all
#--------
# NAT
#--------
nat on $ext_if from $int_if:network to any ($ext_if)
rdr on $ext_if proto udp from any to ($ext_if) port 6666:7000 -> $udpserver
port 6666:7000
rdr on $ext_if proto udp from any to ($ext_if) port 29200 -> $udpserver port
29200
#--------
# Filters
#--------
block log all
pass quick on lo0 all
block drop in quick on $ext_if from $private_networks to any
block drop out quick on $ext_if from any to $private_networks
pass in on $ext_if proto udp from any to $udpserver port { 6666:7000, 29200 }
pass in on $int_if proto udp from any to $udpserver port { 6666:7000, 29200 }
pass in on $int_if from $int_if:network to any keep state
pass out on $int_if from any to $int_if:network keep state
pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto {udp, icmp} all keep state
pass out on $ext_if proto esp all keep state
Thanks for your help,
Frankie.
----- Original Message -----
From: "Rafael Henchen" <rafael@hoplon.com>
To: firewalls@securityfocus.com
Subject: Re: OpenBSD PF problems.
Date: Tue, 22 Mar 2005 16:47:26 -0300
Look at this 2 line in your conf:
pass in on $ext_if from any to $udpserver port 6666
pass in on $int_if from any to $udpserver port 6666 Now try this:
pass in on $ext_if from any to $udpserver port 6666 pass in on
$int_if from $udpserver to any port 6666 I think that is the
solution.
Or you can try
pass in on $ext_if from any to $udpserver port 6666 keep state
If this don't solve your problem try to debug using "tcpdump" in
the interfaces to look the UDP dgrams flowing trought them.
F Walls wrote:
Hi there everybody this is my first post, it might be off-topic,
but here we go:
I am having a problem with a UDP service that I am running, in
that nobody can connect, these are my PF rules:
#-------
# Macros
#-------
Content not important
scrub in all
#--------
# NAT
#--------
nat on $ext_if from $int_if:network to any ($ext_if)
rdr on $ext_if proto udp from any to ($ext_if) port 6666 ->
$udpserver port 6666 #--------
# Filters
#--------
block log all
pass quick on lo0 all
block drop in quick on $ext_if from $private_networks to any
block drop out quick on $ext_if from from any to $private_networks
pass in on $ext_if from any to $udpserver port 6666 pass in on
$int_if from any to $udpserver port 6666 pass in on $int_if from
$int_if:network to any keep state
pass out on $int_if from any to $int_if:network keep state
pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto {udp, icmp} all
pass out on $ext_if proto esp all keep state
Can anybody tell me what the problem is? I really want to know
about the mistake that I am making so all verbose tips would be
appreciated. Also is this PF rule secure?
Frankie
-- Atenciosamente,
Rafael Henchen
System Administrator
- Hoplon Infotainment SA -
--------------------------------------------------------------------------
FREE Download - The Future in Desktop Firewalls is Available Now
NEW NetOp Desktop Firewall, the world's first driver-centric
firewall software - protecting your laptops and corporate PCs at
ring-zero! NetOp features sophisticated process & application
control, centralized management and multiple network user profiles -
NetOp is able to increase security when mobile users plug back into
your network. Step into a more secure future - Try it FREE
http://www.securityfocus.com/sponsor/CrossTec_firewalls_050315
--------------------------------------------------------------------------
--
______________________________________________
Check out the latest SMS services @ http://www.linuxmail.org
This allows you to send and receive SMS through your mailbox.
Powered by Outblaze
--------------------------------------------------------------------------
FREE Download - The Future in Desktop Firewalls is Available Now
NEW NetOp Desktop Firewall, the world's first driver-centric
firewall software - protecting your laptops and corporate PCs at
ring-zero! NetOp features sophisticated process & application
control, centralized management and multiple network user profiles -
NetOp is able to increase security when mobile users plug back
into your network. Step into a more secure future - Try it FREE
http://www.securityfocus.com/sponsor/CrossTec_firewalls_050315
--------------------------------------------------------------------------
--------------------------------------------------------------------------
FREE Download - The Future in Desktop Firewalls is Available Now
NEW NetOp Desktop Firewall, the world's first driver-centric
firewall software - protecting your laptops and corporate PCs at
ring-zero! NetOp features sophisticated process & application
control, centralized management and multiple network user profiles -
NetOp is able to increase security when mobile users plug back
into your network. Step into a more secure future - Try it FREE
http://www.securityfocus.com/sponsor/CrossTec_firewalls_050315
--------------------------------------------------------------------------
