DaemonForums  

Go Back   DaemonForums > OpenBSD > OpenBSD Security

OpenBSD Security Functionally paranoid!

Reply
 
Thread Tools Display Modes
  #1   (View Single Post)  
Old 20th March 2016
Roedy Roedy is offline
New User
 
Join Date: Mar 2016
Posts: 2
Default PF Upgrade to 5.8

Hi,

I have upgraded my router from a freebsd to Openbsd 5.8 with the new PF. Before i used priq which worked quite well. Sadly I am unable to make the new PF configuration work the same way. I hope someone here can point me in the right direction. Below is my configuration:
Code:
INT="vmx0"
EXT="vmx1"
localnet = $INT:network

nas="192.168.1.3"

table <dummies> persist
table <temporary> persist file "/etc/pf/pf_temporary"
table <blocked> persist file "/etc/pf/pf_blocked"
table <spammers> persist file "/etc/pf/pf_spammers"

# Block everything unless otherwise allowed, and queue any state that
# packet might flow into the slow class unless otherwise requeued.
block in log on $EXT
block in log quick from <dummies>
block in log quick from <spammers>
block in log quick from <blocked>
pass quick on lo0 all

match out on $EXT from $localnet to any nat-to $EXT

#allow in some basic services
pass in on $EXT inet proto icmp icmp-type echoreq set prio (5, 6)

# ssh
pass log quick proto tcp from <temporary> to $EXT port ssh flags S/SA keep state \
         (max-src-conn 20, max-src-conn-rate 5/60, \
                 overload <blocked> flush global) set prio (6, 7)

pass quick proto tcp from any to $EXT port ssh flags S/SA keep state \
         (max-src-conn 20, max-src-conn-rate 5/60, \
                 overload <dummies> flush global) set prio (6, 7)

# Skype
pass in on $EXT proto {tcp udp} to port 25601 rdr-to 192.168.1.7 set prio (6, 7)

#Torrent
pass in on $EXT proto {tcp udp} to port {51413} rdr-to $nas set prio (1, 2)


# Pass out rules
pass out quick on $EXT inet proto icmp set prio (6, 7)
pass out quick on $EXT proto {tcp udp} to port {22} set prio (6, 7)
pass out quick on $EXT proto {tcp udp} to port {53} set prio (6, 7)
pass out quick on $EXT proto {tcp udp} to port {123} set prio (6, 7)
pass out quick on $EXT proto {tcp udp} to port {23, 4500, 706, 1863, 5050, 5190, 5222, 6667, 9987} set prio (5, 6)
pass out quick on $EXT proto {tcp udp} to port {25, 80, 443, 8080, 2401, 10838, 18000} set prio (4, 5)

# DotA
pass out quick on $EXT proto {tcp udp} to port {27015:28999} set prio (4, 5)

#torrent
pass out quick on $EXT proto {tcp udp} from port {51413} set prio (1, 2)

# Pass out everything else
pass out quick on $EXT set prio (3, 4)

Last edited by ocicat; 20th March 2016 at 01:05 PM. Reason: added [code] & [/code] tags to bracket command line output
Reply With Quote
  #2   (View Single Post)  
Old 20th March 2016
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 5,975
Default

Hello, and welcome.

There was a long (and sometimes heated) discussion about priority and queueing on the misc@ mailing list at the beginning of the year. This post may be the most informative.

http://marc.info/?l=openbsd-misc&m=145257356119612&w=2
Reply With Quote
  #3   (View Single Post)  
Old 20th March 2016
Roedy Roedy is offline
New User
 
Join Date: Mar 2016
Posts: 2
Default

Thank you very much for your excellent help. That gave me the answer to my problem. I have temporarily installed an OpenBSD 5.4 with the previous pf, which seems to fix my issue. Thanks again!
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
/var/log disappeared after upgrade acampbell OpenBSD Installation and Upgrading 6 25th November 2015 09:14 AM
upgrade from 4.8 to 5.3 polken OpenBSD Installation and Upgrading 6 30th May 2013 05:41 AM
6.1 RC upgrade climby FreeBSD Installation and Upgrading 2 30th September 2010 12:51 PM
How do I upgrade? wubrgamer FreeBSD Ports and Packages 2 27th August 2008 07:18 PM
upgrade from 5.5 to 6.3 keithlybsd FreeBSD Installation and Upgrading 9 27th May 2008 06:21 PM


All times are GMT. The time now is 09:08 AM.


Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2017, Jelsoft Enterprises Ltd.
Content copyright © 2007-2010, the authors
Daemon image copyright ©1988, Marshall Kirk McKusick