PF rule match only packets for local machine

2012-01-05 Thread Robert Wolf
Hallo all, May I ask any PF professional for his advice? I have openbsd router with more interfaces doing routing. It does not work as a firewall so there is only one rule pass flags any no state. Because of many hack-scripts doing SSH logins and filling logs I would like to block every SSH

Re: PF rule match only packets for local machine

2012-01-05 Thread Rafal Bisingier
Hi, On Thursday, 05 Jan 2012 at 09:00 CET Robert Wolf r.wolf.c...@gmail.com wrote: table OutNetworks const { } pass quick proto tcp from OurNetworks to any port 22 no state pass in quick proto tcp from any to any port rdr-to 127.0.0.1 port 22 block quick proto tcp from any to

Re: PF rule match only packets for local machine

2012-01-05 Thread Gregory Edigarov
On Thu, 5 Jan 2012 09:21:16 +0100 Rafal Bisingier ra...@man.poznan.pl wrote: Hi, On Thursday, 05 Jan 2012 at 09:00 CET Robert Wolf r.wolf.c...@gmail.com wrote: table OutNetworks const { } pass quick proto tcp from OurNetworks to any port 22 no state pass in quick proto

Re: PF rule match only packets for local machine

2012-01-05 Thread favar
Hi, start with block rule without quick, then apply pass rules. something like this: table OutNetworks const { } block proto tcp from any to any port 22 pass quick proto tcp from OurNetworks to any port 22 no state pass in quick proto tcp from any to any port rdr-to 127.0.0.1 port 22

Re: PF rule match only packets for local machine

2012-01-05 Thread Stuart Henderson
On 2012-01-05, Gregory Edigarov g...@bestnet.kharkov.ua wrote: On Thu, 5 Jan 2012 09:21:16 +0100 Rafal Bisingier ra...@man.poznan.pl wrote: Hi, On Thursday, 05 Jan 2012 at 09:00 CET Robert Wolf r.wolf.c...@gmail.com wrote: table OutNetworks const { } pass quick proto tcp

Re: PF rule match only packets for local machine

2012-01-05 Thread Robert Wolf
Hallo all, thank you for your answers. table OutNetworks const { } pass quick proto tcp from OurNetworks to any port 22 no state pass in quick proto tcp from any to any port rdr-to 127.0.0.1 port 22 block quick proto tcp from any to any port 22 But of