rdr on firewall initiated connections

2005-03-15 Thread Jon Hart
Greetings, In trying to diagnose a problem with ftp-proxy, I stumbled upon something with pf's rdr that I cannot explain. Assume a simple firewall ruleset. I had the following rdr line: rdr pass on $ext_if proto tcp from any to any \ port 21 -> 127.0.0.1 port 2121 That line, along with t

Static route problem/interaction with pf

2005-03-15 Thread gpontis
I have a system with two ISPs coming in on fxp1 and fxp2. All mail is supposed to be handled through a static IP on fxp1. The ruleset is designed to nat all smtp traffic going out through this public IP, and to forward all incoming smtp to the mail server. In the special case where mail originates

NAT using a CARP interface

2005-03-15 Thread eric
I have a host behind a pair of carp/pfsync machines. It used to be 10.100.81.183, but I moved it behind the firewalls and put 10.100.81.183 on each firewall as carp2 (see below). When trying to connect to www.openbsd.org, I get the following... Mar 15 14:38:06.257369 rule 0/0(match): block in on x

Re: PF, Bridge, and IP on bridged interface [more]

2005-03-15 Thread Jim Fron
On Mar 15, 2005, at 12:20 AM, Sean Kamath wrote: [In a message on Wed, 02 Mar 2005 05:34:20 GMT, [EMAIL PROTECTED] wrote:] In my case, I'm running a SS20 with le* interfaces, which means that all interfaces use the same ethernet address. I'm curious, doesn't setting local-mac-address? to true do

Re: PF, Bridge, and IP on bridged interface [more]

2005-03-15 Thread Ed White
On Tuesday 15 March 2005 12:19, Henning Brauer wrote: > > So, I guess that leaves the question, can one change the ethernet > > address of a NIC with ifconfig on OpenBSD? > > no. Yet. http://marc.theaimsgroup.com/?l=openbsd-tech&m=111073781926839&w=2

Re: PF, Bridge, and IP on bridged interface [more]

2005-03-15 Thread Henning Brauer
* Sean Kamath <[EMAIL PROTECTED]> [2005-03-15 06:40]: > So, I guess that leaves the question, can one change the ethernet > address of a NIC with ifconfig on OpenBSD? no. -- Henning Brauer, BS Web Services, http://bsws.de [EMAIL PROTECTED] - [EMAIL PROTECTED] Unix is very simple, but it takes a

Re: pf vs ASIC firewalls

2005-03-15 Thread Siju George
On Mon, 14 Mar 2005 15:33:02 +, Ryan McBride <[EMAIL PROTECTED]> wrote: > On Mon, Mar 14, 2005 at 03:50:23PM +0530, Siju George wrote: > > Could Someone please tell me the advantages of PF against Firewalls > > using the ASIC technology in terms of Security and perfomance?? > > If there is a b