DaemonForums - View Single Post - Somebody want to log into my OpenBSD website/server

jggimi · #13 **(View Single Post)** 23rd December 2016

Quote:

Originally Posted by psypro

Code:

pass in on egress proto tcp to 192.168.0.2  port 80 keep state   \
                  (max 200, source-track rule, max-src-nodes 100, \
                   max-src-states 3)

Works perfect.

I assume that 192.168.0.2 is a webserver inside your local network, such as:

Code:

{Internet} - a.b.c.d - [Router/PF] - 192.168.0.1 - {LAN} - 192.168.0.2 - [Wordpress server]

Quote:

Then I need to change web server back to nat/firewall pc, for stability it is always one, and to free up hardware and unbound dns and splitt dns was a pain for now to figure out....How to force port 80 traffic reaching the firewall, to go trough the pf filter, like before?

I assume now that you want to move the webserver into your router, such as:

Code:

{Internet} - a.b.c.d - [Router/PF/Wordpress]

If so, your second pass rule will never match any Internet traffic. The local network address 192.168.0.1 is not used by any traffic from or to the Internet. Put your stateful tracking options on the first rule, and delete the second rule (unless you need it to permit local traffic to your webserver).