Ivan Petrushev a écrit :
You should try "pass in on $if proto tcp from any to $ext_ip port $tcp_services flags S/SA keep state" and "pass in on $if proto udp from any to $ext_ip port $udp_services keep state"Hello, I'm trying very simple 'block all, allow a few' firewall, but something doesn't seem right. As far as I remember 'the right matched rule' is taken and executed - this doesn't seem working here. Here is my firewall: ##################### #macros if = "re0" ext_ip = "10.10.10.21" tcp_services = "{http, https, ssh, domain, 5190, 5222, ftp, 1025}" udp_services = "{domain, 5190, 5222, ftp}"#filter block in log on $if pass on $if proto tcp from any port $tcp_services pass on $if proto udp from any port $udp_services #################### The point here is that if a packet for some of the listed service is matching against the rules, it will match the block rule, but after that will match some of the last two and get passed. Instead it gets blocked and I see it into the log: tcpdump -n -i pflog0 19:54:57.657194 IP 64.12.161.185.5190 > 10.10.10.21.54111: tcp 24 [bad hdr length 0 - too short, < 20] (there are many of these, including on the other ports) Now, there is something different. I tried removing the block rule, and added logging for the 'pass' rules. In that case a packet traveling down the rules should match only on the 'pass' rules and get logged. #################### #filter #block in log on $if pass log on $if proto tcp from any port $tcp_services pass log on $if proto udp from any port $udp_services #################### Well, it doesn't get logged. The only thing I see into the log is: 20:12:53.185368 IP 10.10.10.1.53 > 10.10.10.21.60918: [|domain] And more DNS requests. There is nothing from 5190 (ICQ) or 5222 (Gtalk) or 80... What could be wrong here - it is fairly simple ruleset?
Your rule expect the traffic to came FROM $tcp_services but it is goint TO those ports.
You can omit the "flags S/SA keep state" and the "keep state" if you're using FreeBSD 7, it is added automatically.
I would also suggest you to use "block all log" instead of "block in log" and specifiy rules for your outgoing traffic too.
Good luck Martin _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-pf To unsubscribe, send any mail to "[EMAIL PROTECTED]"
