OpenBSD firewall/router, almost there, but . . .

[mefisto]

Hi jggimi,

Originally Posted by jggimi

(You haven't posted the complete pf.conf, so I'm unsure if you've got an early "block quick" which accidentally interferes with the traffic you want to have pass in later rules.)

Well, there are two reasons, one, I am paranoid by nature and due to my occupation and two, I was concerned that someone could just correct the rule - an what would I then learn?

So, I can send it to you via P.M., but if you find the problem, please do not correct it, just give me a hint where my problem could be.

Kindest regards,

M

[jggimi]

For any following along, I was sent the complete configuration via PM, and tested it in a little lab network of virtual machines.

I learned something very useful during the review: if I put a "match log (matches)" rule at the bottom of a PF configuration, it will not add logging to any "quick" rules above it. A "quick" rule that matches will exit PF review immediately, which stops any further PF rules from processing.

When I moved that log rule to the top of the configuration file, I could then easily identify the problem "quick" rule with tcpdump(8).