Date: Tue, 22 Mar 2005 13:18:27 +0100 From: peter@bgnett.no (Peter N. M. Hansteen) To: "Eugene M. Minkovskii" <emin@mccme.ru> Cc: freebsd-questions@freebsd.org Subject: Re: OpenBSD's pf and traffic Message-ID: <86hdj36fho.fsf@amidala.datadok.no> In-Reply-To: <20050322120451.GA3137@mccme.ru> (Eugene M. Minkovskii's message of "Tue, 22 Mar 2005 15:04:51 %2B0300") References: <20050320093159.GA3213@mccme.ru> <861xaamf9t.fsf@amidala.datadok.no> <20050321071227.GA29429@mccme.ru> <86eke9fn7o.fsf@amidala.datadok.no> <20050322120451.GA3137@mccme.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
"Eugene M. Minkovskii" <emin@mccme.ru> writes:
> pass out on $ext_if proto tcp all modulate state flags S/SA
> pass out on $ext_if proto { udp, icmp } all keep state
>
> So, where could I put label to mark inbound traffic? This traffic
> goes into my machine because I use state table.
I'd say something along the lines of
allowed_out = "{ ssh, domain, http, https, etc... }"
pass out on $ext_if proto tcp $allowed_out label allowed-out keep state
you could differentiate among source addresses, for example by
specifying
client1 = "{ 192.68.n.1, 192.168.n.2 }"
client1 = "{ 192.68.n.3, 192.168.n.4 }"
client2_inports = { whatever they need }
pass out on $ext_if from $client1 to any proto tcp $allowed_out \
label client1 keep state
pass out on $ext_if from $client2 to any proto tcp $allowed_out \
label client2-out keep state
pass from any to $client2 $client2_inports label client2-in keep state
and so on. Hope this helps.
--
Peter N. M. Hansteen, member of the first RFC 1149 implementation team
http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/
"First, we kill all the spammers" The Usenet Bard, "Twice-forwarded tales"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?86hdj36fho.fsf>