[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Another problem with pf..
Il Gio, 2004-10-21 alle 21:13, Dimitry Andric ha scritto:
> On 2004-10-21 at 20:29:48 Matteo Riondato wrote:
>
> > pf_enable="YES"
> > pf_rules="/etc/pf.conf"
>
> The last line is not really needed, as it is the default anyway (see
> /etc/defaults/rc.conf).
With or without that line, the situation does not change.
> pfctl -n -v -f /etc/pf.conf
kaiser# pfctl -n -v -f /etc/pf.conf
ext_if = "tun0"
wifi_if = "rl0"
eth_if = "fxp1"
wifi_net = "192.168.1.0/27"
eth_net = "192.168.0.0/29"
tcp_services = "{ 22, 80, 25, 4660 >< 4683, 6890 >< 6901 }"
icmp_types = "{ 0, 3, 8, 11 }"
scrub in all fragment reassemble
block drop all
pass quick on lo0 all
block drop in log quick on ! rl0 inet from 192.168.1.0/24 to any
block drop in log quick inet from 192.168.1.1 to any
block drop in quick on ! fxp1 inet from 192.168.0.0/24 to any
block drop in quick inet from 192.168.0.1 to any
pass in on tun0 inet proto tcp from any to 82.52.115.76 port = ssh flags
S
/SA keep state
pass in on tun0 inet proto tcp from any to 82.52.115.76 port = http
flags
S/SA keep state
pass in on tun0 inet proto tcp from any to 82.52.115.76 port = smtp
flags
S/SA keep state
pass in on tun0 inet proto tcp from any to 82.52.115.76 port 4660 ><
4683
flags S/SA keep state
pass in on tun0 inet proto tcp from any to 82.52.115.76 port 6890 ><
6901
flags S/SA keep state
pass inet proto icmp all icmp-type echorep
pass inet proto icmp all icmp-type unreach
pass inet proto icmp all icmp-type echoreq
pass inet proto icmp all icmp-type timex
pass in on rl0 inet from 192.168.1.0/27 to any keep state
pass out on rl0 inet from any to 192.168.1.0/27 keep state
pass in on fxp1 inet from 192.168.0.0/29 to any keep state
pass out on fxp1 inet from any to 192.168.0.0/29 keep state
pass in on rl0 inet from 192.168.1.200 to 192.168.1.1 keep state
pass out on rl0 inet from 192.168.1.1 to 192.168.1.200 keep state
pass out on tun0 proto tcp all flags S/SA modulate state
pass out on tun0 proto udp all keep state
pass out on tun0 proto icmp all keep state
kaiser#
--
Rionda aka Matteo Riondato
GUFI Staff Member (http://www.gufi.org)
FreeSBIE Developer (http://www.freesbie.org)
BSD-FAQ-it Main Developer (http://utenti.gufi.org/~rionda)
Sent from: kaiser.sig11.org running FreeBSD-6.0-CURRENT
Attachment:
signature.asc
Description: Questa parte del messaggio =?ISO-8859-1?Q?=E8?= firmata
