Re: How to segregate forwarded and firewall-generated traffic in pf?

2013-12-20 Thread Camiel Dobbelaar
On 20/12/13 16:56, Maxim Khitrov wrote: On Thu, Dec 19, 2013 at 8:33 AM, Camiel Dobbelaar wrote: On 18/12/13 22:32, Camiel Dobbelaar wrote: I think a documentation fix for pf.conf(5) is all that can be done. The diff adds the following paragraph: When listening sockets are bound

Re: How to segregate forwarded and firewall-generated traffic in pf?

2013-12-20 Thread Maxim Khitrov
On Thu, Dec 19, 2013 at 8:33 AM, Camiel Dobbelaar wrote: > On 18/12/13 22:32, Camiel Dobbelaar wrote: >> >> On 18/12/13 14:50, Maxim Khitrov wrote: >>> >>> On Wed, Dec 18, 2013 at 8:42 AM, Camiel Dobbelaar wrote: On 18/12/13 13:53, Maxim Khitrov wrote: > > > When writing out

Re: How to segregate forwarded and firewall-generated traffic in pf?

2013-12-19 Thread Giancarlo Razzolini
Em 19-12-2013 11:30, Maxim Khitrov escreveu: > That's pretty much what I managed to come up with yesterday. I have > the following two rules at the top: match out from (self) tag SELF > block out log quick received-on all tagged SELF The second rule is > mostly a sanity check. It ensures that you c

Re: How to segregate forwarded and firewall-generated traffic in pf?

2013-12-19 Thread Camiel Dobbelaar
On 18/12/13 22:32, Camiel Dobbelaar wrote: On 18/12/13 14:50, Maxim Khitrov wrote: On Wed, Dec 18, 2013 at 8:42 AM, Camiel Dobbelaar wrote: On 18/12/13 13:53, Maxim Khitrov wrote: When writing outbound rules in pf, is there an accepted best practice for only matching packets that are either

Re: How to segregate forwarded and firewall-generated traffic in pf?

2013-12-19 Thread Maxim Khitrov
On Thu, Dec 19, 2013 at 7:57 AM, Giancarlo Razzolini wrote: > Em 18-12-2013 21:33, Andy Lemin escreveu: >> Fantastic! Thanks Camiel :) >> >> Sent from my iPhone >> >>> On 18 Dec 2013, at 21:32, Camiel Dobbelaar wrote: >>> On 18/12/13 14:50, Maxim Khitrov wrote: > On Wed, Dec 18, 2013 at

Re: How to segregate forwarded and firewall-generated traffic in pf?

2013-12-19 Thread Giancarlo Razzolini
Em 18-12-2013 21:33, Andy Lemin escreveu: > Fantastic! Thanks Camiel :) > > Sent from my iPhone > >> On 18 Dec 2013, at 21:32, Camiel Dobbelaar wrote: >> >>> On 18/12/13 14:50, Maxim Khitrov wrote: On Wed, Dec 18, 2013 at 8:42 AM, Camiel Dobbelaar wrote: > On 18/12/13 13:53, Maxim Khitro

Re: How to segregate forwarded and firewall-generated traffic in pf?

2013-12-18 Thread Andy Lemin
Fantastic! Thanks Camiel :) Sent from my iPhone > On 18 Dec 2013, at 21:32, Camiel Dobbelaar wrote: > >> On 18/12/13 14:50, Maxim Khitrov wrote: >>> On Wed, Dec 18, 2013 at 8:42 AM, Camiel Dobbelaar wrote: On 18/12/13 13:53, Maxim Khitrov wrote: When writing outbound rules in p

Re: How to segregate forwarded and firewall-generated traffic in pf?

2013-12-18 Thread Camiel Dobbelaar
On 18/12/13 14:50, Maxim Khitrov wrote: On Wed, Dec 18, 2013 at 8:42 AM, Camiel Dobbelaar wrote: On 18/12/13 13:53, Maxim Khitrov wrote: When writing outbound rules in pf, is there an accepted best practice for only matching packets that are either forwarded or firewall-generated? The best t

Re: How to segregate forwarded and firewall-generated traffic in pf?

2013-12-18 Thread Maxim Khitrov
On Wed, Dec 18, 2013 at 8:42 AM, Camiel Dobbelaar wrote: > On 18/12/13 13:53, Maxim Khitrov wrote: >> >> When writing outbound rules in pf, is there an accepted best practice >> for only matching packets that are either forwarded or >> firewall-generated? >> >> The best that I could come up with i

Re: How to segregate forwarded and firewall-generated traffic in pf?

2013-12-18 Thread Camiel Dobbelaar
On 18/12/13 13:53, Maxim Khitrov wrote: When writing outbound rules in pf, is there an accepted best practice for only matching packets that are either forwarded or firewall-generated? The best that I could come up with is 'received-on all' as a way of identifying forwarded packets, but that opt

How to segregate forwarded and firewall-generated traffic in pf?

2013-12-18 Thread Maxim Khitrov
When writing outbound rules in pf, is there an accepted best practice for only matching packets that are either forwarded or firewall-generated? The best that I could come up with is 'received-on all' as a way of identifying forwarded packets, but that option can't be negated to match packets that