LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 12-24-2004, 10:10 PM   #1
lil_drummaboy
Member
 
Registered: May 2003
Location: Victoria, CANADA!
Distribution: OpenBSD, Slackware, Debian
Posts: 85

Rep: Reputation: 15
BSD PF Rule question


Hi,

On my router i want to be able to access ftp/http/etc but I cannot with the current ruleset I have, If i put:

Code:
pass in on $ext_if proto tcp from any to $ext_if
...it works fine but that makes a giant security hole for anyone to exploit. Also turning off PF entirely works aswell but I would like to access the internet while my PF is running. Someone told me a "flags S/SA" would work and only allow connections already made to come back or something along those lines, but that did not work. I think he said to block quick SYN flags then allow the ports under that rule but that didn't work either.

Any suggestions?
 
Old 12-24-2004, 10:26 PM   #2
zaicheke
Member
 
Registered: Apr 2004
Distribution: Slackware 10, Open BSD 3.6, Mac OS 10.3.7, Splack 10 beta
Posts: 393

Rep: Reputation: 30
This only passes traffic in on my internal network if it orginally came from my internal network. So i can access everything but no one can access me.

pass in on $int_if from $int_if:network to any keep state
 
Old 12-24-2004, 10:58 PM   #3
lil_drummaboy
Member
 
Registered: May 2003
Location: Victoria, CANADA!
Distribution: OpenBSD, Slackware, Debian
Posts: 85

Original Poster
Rep: Reputation: 15
great! thanks alot!

merry christmas.
 
Old 12-24-2004, 11:09 PM   #4
lil_drummaboy
Member
 
Registered: May 2003
Location: Victoria, CANADA!
Distribution: OpenBSD, Slackware, Debian
Posts: 85

Original Poster
Rep: Reputation: 15
no wait, that didn't work.

I put in....

Code:
pass in quick on $ext_if inet from $ext_if:network to any keep state
and all it translated to was....

Code:
pass in quick on xl0 inet from 192.168.1.0/24 to any keep state
that doesn't allow me to connect to the net, it allows traffic from my LAN into my router.
 
Old 12-26-2004, 08:59 PM   #5
zaicheke
Member
 
Registered: Apr 2004
Distribution: Slackware 10, Open BSD 3.6, Mac OS 10.3.7, Splack 10 beta
Posts: 393

Rep: Reputation: 30
it works for me. I can access the net with it and i can't ssh to my box unless the box i'm sshing from is on the network. Plus this is a line i got from the PF users guide. It's all there.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Question about a iptables rule? rjw1678 Linux - Security 2 11-18-2005 07:46 AM
Rule Du Jour Question atomicx Linux - General 1 10-12-2005 12:57 PM
Firewall question - stumped by 1 rule! thekillerbean Linux - Networking 4 08-27-2005 01:59 AM
Other Question.. BSD SU Illusion *BSD 3 07-15-2003 10:47 AM
quick question on bsd Crunch Linux - Newbie 2 02-20-2003 04:23 PM


All times are GMT -5. The time now is 03:11 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration