From owner-freebsd-pf@FreeBSD.ORG Sun Jun 19 11:18:55 2005 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 518AB16A41C for ; Sun, 19 Jun 2005 11:18:55 +0000 (GMT) (envelope-from khaled.abu@gmail.com) Received: from wproxy.gmail.com (wproxy.gmail.com [64.233.184.202]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0FFBA43D1F for ; Sun, 19 Jun 2005 11:18:54 +0000 (GMT) (envelope-from khaled.abu@gmail.com) Received: by wproxy.gmail.com with SMTP id 69so291977wra for ; Sun, 19 Jun 2005 04:18:54 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=ecnKUP85GDsF7fJUCJmoMNAKXoYhQsc+JEf8vRkajrNpT4sEvsQhhLFnZOso87CzuqddFCdMB3ojl6uD1BrqR1j+L2+jpFIdU3dwAAXXrkDFVs3vdu87BAtbXsNGMlM8xdNFVqqrgeuugtxlEtrhibsee2B+Bbi2IZWml7VgSKo= Received: by 10.54.98.17 with SMTP id v17mr2150564wrb; Sun, 19 Jun 2005 04:18:54 -0700 (PDT) Received: by 10.54.66.16 with HTTP; Sun, 19 Jun 2005 04:18:54 -0700 (PDT) Message-ID: Date: Sun, 19 Jun 2005 14:18:54 +0300 From: Abu Khaled To: Robert Usle In-Reply-To: <3713853f05061904017a4a7e3f@mail.gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Content-Disposition: inline References: <3713853f05061904017a4a7e3f@mail.gmail.com> Cc: freebsd-pf@freebsd.org Subject: Re: ipfw -pf processing order X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Abu Khaled List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Jun 2005 11:18:55 -0000 On 6/19/05, Robert Usle wrote: > Hi, >=20 > I'm using FreeBSD 5.4 with ipfw (module) & pf (kernel compiled) firewall. >=20 > pf is used for nat, pass/block, rdr, and dummynet/ipfw is used only > for packet queueing. >=20 > ext_if =3D vr0 > int_if =3D rl1 >=20 > ipfw rules: > /sbin/ipfw pipe 10 config bw 256Kbit/s queue 20 mask dst-ip 0x000000ff > /sbin/ipfw pipe 11 config bw 256Kbit/s queue 20 mask src-ip 0x000000ff > /sbin/ipfw add 100 pipe 10 log ip from any to 10.0.9.0/24 > /sbin/ipfw add 101 pipe 11 log ip from 10.0.9.0/24 to any >=20 > sysctl: net.inet.ip.fw.one_pass: 1 > (I've also tried with 'via','xmit','recv' tags) >=20 > I see packets coming to my dummynet pipes/rules, but then > pf rdr rule: >=20 > rdr on $int_if proto tcp from $internal_net to any port 80 -> > 127.0.0.1 port 3128 >=20 > does not work. > When i disable ipfw firewall, it's just ok again. >=20 > pf options are as follows: > set optimization normal > set block-policy drop > set require-order yes > scrub in all >=20 > Is this related to firewall processing order ? >=20 > Thanks, >=20 > -- > Robert My guess is that IPFW is blocking packets from your $internal_net to localhost port 3128. Add this to your IPFW rules before any other rules that block traffic to 127.0.0.1 # ipfw 100 allow tcp from $internal_net to 127.0.0.1 3128 # ipfw 200 allow tcp from 127.0.0.1 3128 to $internal_net for example: ipfw add 100 pass all from any to any via lo0 ipfw add 200 allow tcp from $internal_net to 127.0.0.1 3128 ipfw add 300 allow tcp from 127.0.0.1 3128 to $internal_net ipfw add 400 deny all from any to 127.0.0.0/8 ipfw add 500 deny ip from 127.0.0.0/8 to any --=20 Kind regards Abu Khaled