Simple Firewall with PF

[jones]

Hi, this thread could fit into many different forums here, please move it if it will suit somewhere else better

I am trying to set up my laptop(PC-BSD 7.0) to act as a router allowing my eee running OpenBSD to connect to my university wireless network.

The uni network use a WPA-Enterprise network, that isnt supported by openbsd yet, but i have working with the PC-BSD laptop. The network uses a proxy for http connections, but this might also effect other traffic I havent found a conclusive result yet.

I have two network interfaces rum0(connects to uni wireless) and bge0 (to connect to the OpenBSD machine).

I am not entirely sure the steps i need to set this up, so far i have gotten a basic pf.conf together(mostly gleamed for the book of PF), but with this config the PC-BSD machine cannot get any connection to the outside world.

ext_if = "rum0"         ##Macro for uniwireless network
int_if = "bge0"         ##Macro for openbsd network
localnet = $int_if:network
client_out = "{ssh, domain, auth, nntp,http,\
                https,2628,5999,8000,8080}"
udp_services = "{domain}"
icmp_types = "{ echoreq,unreach }"

nat on $ext_if from $localnet to any -> ($ext_if)

block all

pass quick inet proto {tcp, udp} from $localnet to any port $udp_services
pass log inet proto icmp all icmp-type $icmp_types
pass inet proto tcp from $localnet to any port $client_out

Any help with getting this connection up and running is much appreciated

[DutchDaemon]

Do you have forwarding enabled?

sysctl net.inet.ip.forwarding should be 1.

[jones]

The sysctl wasn't set, thanks for that. My issue is that i cannot get DNS to resolve with that PF rule set, its probably just my lack of knowledge, am i missing something obvious?

[DutchDaemon]

I'm not sure how new PF is on PC-BSD. When you run pfctl -s rules, do you see stuff like flags S/SA and keep state in them? If not, you will have to add them, especially the keep state directives. Add 'log' to the block all rule and run a tcpdump on pflog0 to see what actually gets blocked (you'll have to take 'log' out of that pass rule, or it'll confuse you)..

P.S. add set skip on lo0 - things may break without it; if you trust everything on your local network, add set skip on bge0 as well.