Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 01 Mar 2005 18:14:19 -0500
From:      Gerard Samuel <fbsd-pf@trini0.org>
To:        freebsd-pf@freebsd.org
Subject:   Whats wrong with this ruleset?
Message-ID:  <4224F74B.1030502@trini0.org>

next in thread | raw e-mail | index | archive | help
For some reason, port 53 is blocked going out of the external interface ->
000000 rule 0/0(match): block out on ed0: IP xx.xxx.xxx.xx.53 > 
xx.xx.xx.xxx.4973

Im still new to pf, but shouldn't the last two lines allow anything 
going out
to pass??
Any ideas on how to fix?
Thanks for your time

----
# macros
int_if = "fxp0"
ext_if = "ed0"

tcp_services = "{ 22, 113 }"
icmp_types = "echoreq"

priv_nets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"

hivemind = "192.168.0.2"
www      = "10.0.0.1"

isp_dhcp = "xx.xx.xx.xx"

# options
set block-policy return
set loginterface $ext_if

# scrub
scrub in all

# nat/rdr
nat on $ext_if from $int_if:network to any -> ($ext_if)

rdr on $ext_if proto tcp from any to any port 22 -> $hivemind
rdr on $ext_if proto tcp from any to any port 25 -> $hivemind
rdr on $ext_if proto tcp from any to any port 80 -> $www
rdr on $ext_if proto tcp from any to any port 110 -> $hivemind


# filter rules
block log all

pass quick on lo0 all

block drop in  quick on $ext_if from $priv_nets to any
block drop out quick on $ext_if from any to $priv_nets

pass in on $ext_if inet proto tcp from any to ($ext_if) port 
$tcp_services flags S/SA keep state

pass in on $ext_if proto {udp} from $isp_dhcp to any port 68

pass in on $ext_if proto {tcp} from any to any port 22

pass in on $ext_if proto {tcp, udp} from any to any port 53

pass in on $ext_if proto {tcp} from any to any port 25
pass in on $ext_if proto {tcp} from any to any port 110

pass in on $ext_if proto tcp from any to $www port 80 flags S/SA 
synproxy state

pass in inet proto icmp all icmp-type $icmp_types keep state

pass in on $int_if from $int_if:network to any keep state
pass out on $int_if from any to $int_if:network keep state

pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto {udp, icmp} all keep state



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4224F74B.1030502>