myanushurts
Member
Einen wunderschönen guten Tag wünsche ich allerseits.
Ich hab ein kleines Problem mit pf unter FreeBSD 6.1, und zwar versuche ich Portranges zu einem in einem Jail laufenden Dienst (bittorrent und pureftpd) durchzureichen, scheitere aber kläglich.
Meine pf.conf
Der Teil von Interesse ist:
Habe mich an:
$p2p_addr port 49160:49300
$p2p_addr
$p2p_addr port 49160:*
versucht, keine der Varianten brachte den erwünschten Effekt.
Wäre nett wenn jemand Licht in mein Dunkel bringen könnte. Sonstige Kommentare zu Dummheiten meinerseits bzw. Verbesserungsvorschläge sind natürlich auch willkommen.
Ich hab ein kleines Problem mit pf unter FreeBSD 6.1, und zwar versuche ich Portranges zu einem in einem Jail laufenden Dienst (bittorrent und pureftpd) durchzureichen, scheitere aber kläglich.
Meine pf.conf
Code:
# Macros: define common values, so they can be referenced and changed easily.
ext_if="tun0" # replace with actual external interface name i.e., dc0
int_if="xl0" # replace with actual internal interface name i.e., dc1
vpn_if="tun1"
www_addr="192.168.8.253"
ftp_addr="192.168.8.251"
p2p_addr="192.168.8.252"
xenon="192.168.8.50"
internal_net="192.168.8.0/24"
external_addr="tun1"
ipphone="192.168.8.3"
# Tables: similar to macros, but more flexible for many addresses.
#table <foo> { 10.0.0.0/8, !10.1.0.0/16, 192.168.0.0/24, 192.168.1.18 }
table <firewall> const { self }
set skip on lo0
# Normalization: reassemble fragments and resolve or reduce traffic ambiguities.
scrub in all
# Translation: specify how addresses are to be mapped or redirected.
# nat: packets going out through $ext_if with source address $internal_net will
# get translated as coming from the address of $ext_if, a state is created for
# such packets, and incoming packets will be redirected to the internal address.
nat on $ext_if from $internal_net to any -> ($ext_if)
rdr on $ext_if proto tcp from any to any port 80 -> $www_addr port 80
rdr on $ext_if proto tcp from any to any port 443 -> $www_addr port 443
rdr on $ext_if proto tcp from any to any port 21 -> $ftp_addr port 21
rdr on $ext_if proto tcp from any to any port 45000:50000 -> $ftp_addr
rdr on $ext_if proto tcp from any to any port 9881:9888 -> $p2p_addr port 9881:9888
rdr on $ext_if proto tcp from any to any port 8662 -> $p2p_addr port 8662
rdr on $ext_if proto tcp from any to any port 49160:49300 -> $p2p_addr port 49160:49300
rdr on $ext_if proto udp from any to any port 49160:49300 -> $p2p_addr port 49160:49300
rdr on $ext_if proto tcp from any to any port 41300 -> $xenon port 41300
rdr on $ext_if proto udp from any to any port 41300 -> $xenon port 41300
# Filtering: the implicit first two rules are
pass in all
pass out all
pass in on $int_if from 192.168.8.0/24 to 192.168.8.254
pass out on $int_if from 192.168.8.254 to 192.168.8.0/24
pass in on $int_if from 172.16.0.1/24 to 192.168.8.254
pass out on $int_if from 192.168.8.254 to 172.16.0.1/24
pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto { udp, icmp, gre } all keep state
block return log on $ext_if all
pass in on $ext_if proto tcp from any to any port 1194 keep state
pass in on $ext_if proto tcp from any to $www_addr port 443 keep state
pass in on $ext_if proto tcp from any to $www_addr port 80 keep state
pass in on $ext_if proto tcp from any to $ftp_addr port 21 keep state
pass in on $ext_if proto tcp from any to $ftp_addr port 45000:50000 keep state
pass in on $ext_if proto tcp from any to $p2p_addr port 8662 keep state
pass in on $ext_if proto tcp from any to $p2p_addr port 9881:9888 keep state
pass in on $ext_if proto tcp from any to $p2p_addr port 49160:49300 keep state
pass in on $ext_if proto udp from any to $p2p_addr port 49160:49300 keep state
pass in on $ext_if proto udp from any to any port 7400:7402 keep state
pass in on $ext_if proto tcp from any to any port 7400:7402 keep state
pass in on $ext_if proto tcp from any to any port 58713 keep state
pass in on $ext_if proto udp from any to any port 58713 keep state
pass in on $ext_if proto tcp from any to any port 41300 keep state
pass in on $ext_if proto udp from any to any port 41300 keep state
pass out on $ext_if proto { tcp, udp, gre } all keep state
pass on $ext_if inet proto icmp all icmp-type 8 code 0 keep state
pass out on $ext_if proto udp all keep stateDer Teil von Interesse ist:
Code:
rdr on $ext_if proto tcp from any to any port 45000:50000 -> $ftp_addr
rdr on $ext_if proto tcp from any to any port 49160:49300 -> $p2p_addr port 49160:49300
rdr on $ext_if proto udp from any to any port 49160:49300 -> $p2p_addr port 49160:49300
pass in on $ext_if proto tcp from any to $ftp_addr port 45000:50000 keep state
pass in on $ext_if proto tcp from any to $p2p_addr port 49160:49300 keep state
pass in on $ext_if proto udp from any to $p2p_addr port 49160:49300 keep state$p2p_addr port 49160:49300
$p2p_addr
$p2p_addr port 49160:*
versucht, keine der Varianten brachte den erwünschten Effekt.
Wäre nett wenn jemand Licht in mein Dunkel bringen könnte. Sonstige Kommentare zu Dummheiten meinerseits bzw. Verbesserungsvorschläge sind natürlich auch willkommen.
