PF firewall

[bsdnewbie999]

Currently, I cannot surf the web from my firewall. I don know why because i thought i already pass in the port www. Please help
Here are my sample of rules

# Macros
int_if="vic0"

#scrub
scrub in all

# Filtering rules
pass in on $int_if proto tcp from any to $int_if port www
pass out on $int_if proto tcp from $int_if to any port www
block in log quick on $int_if proto tcp from any to any port ssh flags S/SA

 
#Antispoof
antispoof log for $int_if inet

#Unicast reverse path forwarding
block in log quick from urpf-failed label uRPF

#Passive operating system fingerprinting
pass in log on $int_if from any os OpenBSD keep state
block in log on $int_if from any os "Windows 2000"
block in log on $int_if from any os "Windows XP"
block in log on $int_if from any os "Windows XP SP1"
block in log on $int_if from any os "Windows XP SP2"
block in log on $int_if from any os "Windows xP SP3"
block in log on $int_if from any os "Windows 98"
block in log on $int_if from any os "Windows NT"
block in log on $int_if from any os "Linux 2.4 ts"
block in log on $int_if from any os unknown

# return
block return

#Block ICMP redirect packets
block in log quick on $int_if inet proto icmp from any to $int_if 
block in log quick on $int_if inet proto icmp from any to $int_if icmp-type redir

#Block SMTP(simple mail transfer protocol)
block in log quick on $int_if inet proto tcp from any to $int_if port smtp

#pass out UDP and ICMP
pass out on $int_if inet proto udp all keep state
pass out on $int_if inet proto icmp from $int_if to any keep state

#Block everything
block return-rst in log quick on $int_if inet proto tcp from any to $int_if 
block return-icmp in log quick on $int_if inet proto udp from any to $int_if
block in quick on $int_if all

[jggimi]

As I stated in http://www.daemonforums.org/showthre...2948#post21892, unless quick is used, the last matching rule applies.

I notice you have "block return" in the middle of your ruleset. This will match all packets. Your prior "pass" rule does not apply.

[alekid]

in /etc/sysctl.conf | net.inet.ip.forwarding=1
-check your /etc/resovl.conf
#resolv.conf
lookup file bind
nameserver 127.0.0.1

more: http://www.openbsd.org/faq/pf/

[geekswordsman]

Originally Posted by jggimi

As I stated in http://www.daemonforums.org/showthre...2948#post21892, unless quick is used, the last matching rule applies.

I notice you have "block return" in the middle of your ruleset. This will match all packets. Your prior "pass" rule does not apply.

jggimi's right on the money. When PF receives a packet, it goes line by line looking for a rule to apply it to - but it doesn't stop just because it finds one. It keeps going and looks for any other rules that might apply, and finally makes a decision on what to do at the end of pf.conf. The only time that you can skip this from happening is the quick rule, ie

pass in quick on $int_if from any to $int_if port www

Personally, I always build my pf.conf file with the block rule at top - and usually with a nice simple

BLOCK IN LOG ALL

I can build my exceptions (say, my vonage VoIP line) after the fact, and if something isn't getting through that's supposed to be, I know it must be because I haven't setup a pass rule correctly.