DaemonForums  

Go Back   DaemonForums > FreeBSD > FreeBSD Security

FreeBSD Security Securing FreeBSD.

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1   (View Single Post)  
Old 23rd November 2015
jasonvp's Avatar
jasonvp jasonvp is offline
Real Name: Jason
Port Guard
 
Join Date: Nov 2015
Location: Northern VA
Posts: 15
Default PF: Help With Tables vs Macros

Hey gang -

I posted this over on the FreeBSD.org forums, and figured I'd post it here, too. I just built a new server running FreeBSD 10.2 and locked it down with pf. After spinning up a bunch of jails (sendmail over here, named over there, a few web servers here and there, etc) I punched holes in the pf.conf to allow traffic to and from them. I did so using macros in the /etc/pf.conf file.

All good.

A few of the macros allow a range of loopbacks to talk to one another so that the jails can actually communicate internally with themselves. Meaning: jail1 can talk to jail1 via its loopback. Jail2 can talk to jail2 via it's loopback, etc.

Code:
# IPv4 and v6 loopbacks
ipv4_loopback = "{ 127.0.0.0/8 }"
ipv6_loopback = "{ ::/64 }"
.
.
.
pass in quick from $ipv4_loopback to $ipv4_loopback
pass in quick from $ipv6_loopback to $ipv6_loopback
And as a test, I have a sendmail milter installed on one of my jails that its sendmail talks to via 127.0.0.1. That works.

I tried to get tricky and convert the macros over to tables, like so:
Code:
# IPv4 and v6 loopbacks
table <ipv4_loopback> const {127.0.0.0/8}
table <ipv6_loopback> const {::/64}
.
.
.
# Local loop to loop allows
pass in quick from <ipv4_loopback> to <ipv4_loopback>
pass in quick from <ipv6_loopback> to <ipv6_loopback>
Once I did that and loaded the new rules, sendmail on that aforementioned jail could no longer talk to its local (127.0.0.1) milter. I even tried to telnet to the milter's port on the jail and no luck. Reverting the pf rules back to macros worked.

So: I clearly don't understand the use of tables vs macros. Any guidance? Calling me an idiot is perfectly acceptable here if I'm doing something drastically stupid.

Thanks!
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
pf.conf place multiple tables in one variable daemonbak OpenBSD Security 1 21st July 2015 10:12 AM
VPN Client (tun) and routing tables irukandji General software and network 2 30th September 2014 05:29 AM
OpenBSD 5.0 and Current i386 buggy acpi tables shep OpenBSD Installation and Upgrading 6 14th July 2014 09:16 PM
pf tables how long values stored ijk FreeBSD Security 3 12th August 2008 11:45 AM
PF <tables> hunteronline FreeBSD Security 8 16th July 2008 08:52 PM


All times are GMT. The time now is 12:45 AM.


Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2018, Jelsoft Enterprises Ltd.
Content copyright © 2007-2010, the authors
Daemon image copyright ©1988, Marshall Kirk McKusick