Sorry, I grabbed pf.conf from the wrong machine. I basically just copied the previous one, made the couple changes I needed. The real difference is that there's no UDP in, and not as many TCP ins are allowed:
# ------- pf.conf skeleton for server # # --------------- MACRO Section ----------------- EXT_IF="rl0" PING = "echoreq" # --- allowed incoming services initiated by clients TCP_IN = "{ ssh }" #UDP_IN = "{ }" # --- allowed services initiated by server TCP_OUT = "{ ssh, ftp, http, ntp, 5999 }" UDP_OUT = "{ domain, ntp }" # ------------------ TABLE Section -------------- # ------------------ OPTIONS Section set loginterface $EXT_IF # --------- TRAFFIC NORMALIZATION ---------------- scrub in all # ---------- TRANSLATION Section (NAT/RDR) # ---------- FILTER section # --- DEFAULT POLICY block log all # --- LOOPBACK pass quick on lo0 all # ======================= INCOMING ================ # ----------- EXTERNAL INTERFACE # --- TCP pass in quick on $EXT_IF inet proto tcp from any to $EXT_IF port $TCP_IN flags S/SA keep state # --- UDP #pass in quick on $EXT_IF inet proto udp from any to $EXT_IF port $UDP_IN keep state # --- ICMP pass in quick on $EXT_IF inet proto icmp from any to $EXT_IF icmp-type $PING keep state # ======================= OUTGOING ================ # ----------- EXTERNAL INTERFACE # --- TCP pass out quick on $EXT_IF inet proto tcp from $EXT_IF to any port $TCP_OUT flags S/SA keep state # --- UDP pass out quick on $EXT_IF inet proto udp from $EXT_IF to any port $UDP_OUT keep state # --- ICMP pass out quick on $EXT_IF inet proto icmp from $EXT_IF to any icmp-type $PING keep state # ----------------- end of pf.conf On Thu, 31 Mar 2005 10:30:53 -0700, Pat Maddox <[EMAIL PROTECTED]> wrote: > FreeBSD 5.3-RELEASE-p5. I'm not sure how to check the pf version. > > I just started getting this error a couple days ago, and I've got > absolutely no clue why. I don't recall making any significant changes > to the box. Anyway, here's pf.conf: > > # ------- pf.conf skeleton for server > # > # --------------- MACRO Section ----------------- > > EXT_IF="fxp0" > > PING = "echoreq" > > # --- allowed incoming services initiated by clients > > TCP_IN = "{ ssh, smtp, ftp, imap, http, 5001, 5002, 5003, 5004, 5005 }" > UDP_IN = "{ domain }" > > # --- allowed services initiated by server > > TCP_OUT = "{ ssh, smtp, ftp, http, ntp, 5999 }" > UDP_OUT = "{ domain, ntp }" > > # ------------------ TABLE Section -------------- > > # ------------------ OPTIONS Section > set loginterface $EXT_IF > > # --------- TRAFFIC NORMALIZATION ---------------- > scrub in all > # ---------- TRANSLATION Section (NAT/RDR) > > # ---------- FILTER section > > # --- DEFAULT POLICY > block log all > > # --- LOOPBACK > pass quick on lo0 all > > # ======================= INCOMING ================ > # ----------- EXTERNAL INTERFACE > > # --- TCP > pass in quick on $EXT_IF inet proto tcp from any to $EXT_IF port > $TCP_IN flags S/SA keep state > > # --- UDP > pass in quick on $EXT_IF inet proto udp from any to $EXT_IF port > $UDP_IN keep state > > # --- ICMP > pass in quick on $EXT_IF inet proto icmp from any to $EXT_IF icmp-type > $PING keep state > > # ======================= OUTGOING ================ > # ----------- EXTERNAL INTERFACE > > # --- TCP > pass out quick on $EXT_IF inet proto tcp from $EXT_IF to any port > $TCP_OUT flags S/SA keep state > > # --- UDP > pass out quick on $EXT_IF inet proto udp from $EXT_IF to any port > $UDP_OUT keep state > > # --- ICMP > pass out quick on $EXT_IF inet proto icmp from $EXT_IF to any > icmp-type $PING keep state > > # ----------------- end of pf.conf > > > On Thu, 31 Mar 2005 12:31:13 +0200, Peter N. M. Hansteen > <[EMAIL PROTECTED]> wrote: > > Pat Maddox <[EMAIL PROTECTED]> writes: > > > > > I'm trying to set up PF on a server, and when I run pfctl -nf > > > /etc/pf.conf, I get the following error: > > > pfctl: ifa_load: pfi_get_ifaces: Bad file descriptor > > > > More info is required. > > > > Which FreeBSD and PF versions (not all permutations of pf and FreeBSD > > will work, see the handbook), pf relevant rc.conf lines, your pf.conf, > > ifconfig output > > > > > Google doesn't come up with anything, I've got no clue what that is. Any > > > help? > > > > Check your ruleset for obvious errors, such as trying to address a > > non-existent interface. Then again, this is guesswork based on very > > little information. > > > > -- > > Peter N. M. Hansteen, member of the first RFC 1149 implementation team > > http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/ > > "First, we kill all the spammers" The Usenet Bard, "Twice-forwarded tales" > > > > _______________________________________________ > > freebsd-questions@freebsd.org mailing list > > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > > To unsubscribe, send any mail to "[EMAIL PROTECTED]" > > > _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"