From owner-freebsd-pf@FreeBSD.ORG Thu May 4 05:33:17 2006 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9445F16A403 for ; Thu, 4 May 2006 05:33:17 +0000 (UTC) (envelope-from huzeyfe.onal@gmail.com) Received: from nz-out-0102.google.com (nz-out-0102.google.com [64.233.162.201]) by mx1.FreeBSD.org (Postfix) with ESMTP id ECE8043D48 for ; Thu, 4 May 2006 05:33:16 +0000 (GMT) (envelope-from huzeyfe.onal@gmail.com) Received: by nz-out-0102.google.com with SMTP id l1so359443nzf for ; Wed, 03 May 2006 22:33:16 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=ZOmNRpXvSH3O18jVNUVBg/hcCfK749d8XxbD37k6Oz+LAWBKfePNhmZmc+GiXMY0OV0NZOJ+uzpuJpUHRtgn3nQ15n5RpQ5X1yQkfhdrCIjw2y3Wa5M9XhPockPS9+Hcy4qZp4YxqSsjI5XY/KmxX2egkuA+Lj2V5Zo1MdHj/WM= Received: by 10.65.84.3 with SMTP id m3mr242324qbl; Wed, 03 May 2006 22:33:16 -0700 (PDT) Received: by 10.65.75.18 with HTTP; Wed, 3 May 2006 22:33:16 -0700 (PDT) Message-ID: Date: Thu, 4 May 2006 08:33:16 +0300 From: "Huzeyfe Onal" To: "Aguiar Magalhaes" In-Reply-To: <20060504034002.20589.qmail@web31609.mail.mud.yahoo.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: quoted-printable Content-Disposition: inline References: <20060504034002.20589.qmail@web31609.mail.mud.yahoo.com> Cc: freebsd-pf@freebsd.org Subject: Re: Something is wrong X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 May 2006 05:33:17 -0000 Hi, does lan_to_int includes port 19336 or 8081? On 5/4/06, Aguiar Magalhaes wrote: > List, > > I have a lot of Windows Internet Explorer browsers in > the > LAN and they are marked to use the proxy at 3128 port. > > The pf and squid are in the same machine. I'm not > using transparent proxy on pf. I don't have any > redirections to proxy. > > Some applications in intranet pages use ports like > 19336 or 8081 and they don't support the proxy. > > I need to tell to pf doesn't send the packages to the > proxy, if the users are accessing those applications > pages, but I'm not have success.. > > My firewall has only two NICs: $int_if and $ext_if > > Could you help me ? Thanks, Aguiar > > The rules are: > > - - - - - - - - > internal_net =3D "172.16.0.0/12" > fw_ip_int =3D "172.16.0.9" > fw_ip_ext =3D "200.x.x.x" > lan_to_int =3D "{ 25 123 ... etc } > > set optimization aggressive > scrub in all > nat on $ext_if from $internal_net to any -> $fw_ip_ext > rdr on $int_if proto tcp from $internal_net to any > port 21 -> 127.0.0.1 port 8081 > pass quick on lo0 all > antispoof for $ext_if inet > > block log all > pass in on $int_if inet proto tcp from $internal_net > to 127.0.0.1 port 8081 keep state > pass in on $int_if inet proto tcp from $internal_net > to { $fw_ip_int $fw_ip_ext } port 3128 keep state > pass in on $int_if inet proto udp from $internal_net > to any port 53 keep state > pass in on $int_if inet proto tcp from $internal_net > to any port $lan_to_int keep state > > # Access permitted out of the proxy (not is ok...) > pass inet proto tcp from { 172.16.1.16 172.16.1.165 > 172.16.1.203 } to 201.x.x.x port { 80 3128 8081 } keep > state > > pass out from $fw_ip_ext to any keep state > - - - - - - - - - - - - > > > > _______________________________________________________ > Novo Yahoo! Messenger com voz: Instale agora e fa=E7a liga=E7=F5es de gra= =E7a. > http://br.messenger.yahoo.com/ > _______________________________________________ > freebsd-pf@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-pf > To unsubscribe, send any mail to "freebsd-pf-unsubscribe@freebsd.org" > -- Huzeyfe =D6NAL --- First Turkish Qmail book is out! Go check it. Duydunuz mu! Turkiye'nin ilk Qmail kitabi cikti. http://www.acikakademi.com/catalog/qmail/