Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 25 Apr 2005 07:41:34 -0500
From:      "Fafa Diliha Romanova" <fteg@london.com>
To:        questions@freebsd.org
Subject:   PF problem!!!
Message-ID:  <20050425124134.A19F04BEAD@ws1-1.us4.outblaze.com>

next in thread | raw e-mail | index | archive | help
Hello!

I am running FreeBSD 5.4-STABLE, with PF as firewall and NAT server.

My question is: Why do I have to type this after everytime I've rebooted
to make my NAT gateway server allow Internet access to my workstation?

# pfctl -F a ; pfctl -Nf /etc/pf.conf ; pfctl -sr

Here is my /etc/pf.conf:

int_if=3D"ep0"
ext_if=3D"lnc0"

# *** Options
#
set     block-policy drop

# *** Scrub incoming packets
#
scrub   in all

# *** NAT
#
nat     on $ext_if from $int_if:network to any -> ($ext_if)
rdr     on $int_if proto tcp from any to any \
        port 21 -> 127.0.0.1 port 8021

# *** Default deny policy
#
block   drop log all

# *** Pass loopback traffic
#
pass    quick on lo0 all

# *** Outgoing
#
#
pass    out on $ext_if inet proto tcp \
        from any to any flags S/SA keep state
pass    out on $ext_if inet proto { udp, icmp } \
        from ($ext_if) to any keep state

# *** Bootstrap
#
pass    out on $ext_if inet proto udp \
        from any port 68 to any port 67 keep state

# *** DNS and NTP
#
pass    out on $ext_if inet proto udp \
        from ($ext_if) to any port { 53, 123 } keep state

# *** SSH and HTTP
#
pass    in on $ext_if inet proto tcp \
        from any to ($ext_if) port { 22, 80 } flags S/SA keep state

# *** Active FTP
#
pass    in on $ext_if inet proto tcp \
        from port 20 to ($ext_if) user proxy flags S/SA keep state

Thanks all!
-- Fafa

--=20
___________________________________________________________
Sign-up for Ads Free at Mail.com
http://promo.mail.com/adsfreejump.htm



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050425124134.A19F04BEAD>