|
OpenBSD Security Functionally paranoid! |
|
Thread Tools | Display Modes |
|
|||
Separate filter rules for two ethernet devices
If i have two ethernet devices, say rl0 and msk0 and i would like to block all incoming traffic on all ports, except port 80 and 443, but only on msk0, then is that possible?
|
|
|||
Thanks, so this has to go into pf.conf?
Also, will not this block all on rl0 too? I only would like to block everything on msk0 and apply no filter on rl0. |
|
||||
Yes, the default PF configuration file is /etc/pf.conf.
Quote:
Code:
block in on msk0 pass in proto tcp to (msk0) port {80 443} |
|
|||
First i was going to say that, but i have explicitedly said, that "but only on msk0", but you're actually right, my statement can be interpreted either as "block everything, but enable 80 and 440 on msk0", or as "block everything on msk0, but 80 and 440".
Anyway, thank you very much, that will perfectly do it. |
|
|||
BTW, this will work, even if msk0 is PPPoE, right?
|
|
||||
An empty PF configuration file will pass all traffic on all interfaces, as if you'd provisioned a single rule containing the two words pass all. So absent any other rules, the most recent example will pass all traffic on all interfaces except msk0.
The most general rule is the first, blocking all incoming traffic on the msk0 interface. All outgoing traffic already passes. The second rule is more fine-grained, and passes traffic to destination ports 80/443, if the destination address is any of the addresses assigned to the msk0 interface. Internally, there are individual rules for each address, which can be seen with # pfctl -sr .The parentheses around the interface will cause PF to adjust the internal rule list any time the address list changes, such as may happen with dynamic auto-configuration with SLAAC / IPv6 or DHCP / IPv4. Last edited by jggimi; 11th July 2022 at 03:58 PM. Reason: clarity |
|
|||
Thank you for the detailed explanation. However this is not entirely clean to me:This applies to PPPoE devices too, right?
|
|
|||
I see, thanks.
|
|
|||
I will.
BTW, i think i got something wrong about PPPoE; can /etc/netstart "launch" a device which is configured as PPPoE in /etc/hostname.msk0? |
|
|||
I never had to use PPPOE either. But pppoe(4) says that your /etc/hostname.msk0 should only contain the word 'up'.
The /etc/hostname.pppoe0 should contain pppoedev msk0 So # /etc/netstart pppoe0 should do it.
__________________
You don't need to be a genius to debug a pf.conf firewall ruleset, you just need the guts to run tcpdump |
|
|||
I see, thanks. So, that was i was doing wrong: putting the PPPoE credentials to the wrong file.
|
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
BGP in separate rdomains | fencepencil | OpenBSD General | 3 | 27th February 2020 09:37 PM |
PDF/Postscript -> print filter -> Print Queue Filter | shep | Programming | 6 | 24th December 2018 03:33 PM |
ethernet > wifi > ethernet more seamlessly? FreeBSD | jb_daefo | General software and network | 1 | 6th May 2016 07:17 PM |
Adding a separate /home | JMJ_coder | NetBSD General | 2 | 29th August 2008 10:45 AM |
/etc on a separate partition | DarkEnergy | FreeBSD Installation and Upgrading | 13 | 20th May 2008 04:24 AM |