[phusion2k]

Hi, I've been having a problem with OpenBSD pf logging port 22 traffic. Here is some of my pf.conf file. Let me know what you think. Thanks.

######################
# Packet Filtering
######################

# Rules for internal interfaces
######################
# pass on unfiltered interfaces
pass quick on $unfiltered

# silently drop TCP non-SYN packets, the remaining ruleset only deals with
# TCP SYNs, which always create state when passed. the ruleset basically
# deals with 'connections', not packets, beyond this point.
block return-rst quick inet proto tcp all flags /S
block return-rst quick inet proto tcp all flags A/A

# block everything by default
block
block return-rst inet proto tcp
block return-icmp inet proto udp

# Rules for external interface
######################
# silently drop broadcasts
block in quick on $ext_if inet from any to { 255.255.255.255 }

# block incoming packets from reserved address space and invalid
# addresses, they are either spoofed or misconfigured, we can't reply to
# them anyway (hence, no return-rst).
block in quick on $ext_if inet from <unroutable> to any

# block outgoing packets that don't have my address as source, they are
# either spoofed or something is misconfigured (NAT disabled, for instance),
# we want to be nice and not send out garbage.
block out quick on $ext_if inet from !$ext_if to any

# ICMP
# internal hosts can send icmp queries and accept echo replies to external hosts
pass out on $ext_if inet proto icmp from $ext_if to any \
icmp-type $icmp_types $icmp_options

# UDP
pass out on $ext_if inet proto udp from any to any \
$udp_options
pass in on $ext_if inet proto udp from any to $ext_if \
port $udp_services $udp_options

# TCP
pass in log on $ext_if inet proto tcp from any to $ext_if \
port 22 $tcp_options
pass out on $ext_if inet proto tcp from $ext_if to any \
$tcp_options
pass in on $ext_if inet proto tcp from any to $ext_if \
port $tcp_services $tcp_options

[elmore]

ummmm....

You've told pf to log port 22 traffic.


# TCP
pass in log on $ext_if inet proto tcp from any to $ext_if \
port 22 $tcp_options


Just put:


# TCP
pass in quick on $ext_if inet proto tcp from any to $ext_if \
port 22 $tcp_options


Should clear it up for you.

[phusion2k]

my current rule allows traffic to go to port 22, but i also want to log the traffic

[elmore]

've been having a problem with OpenBSD pf logging port 22 traffic.


I thought you didn't want pf to log the traffic. I guess I misunderstood or am confused as to what you want to accomplish here. Do you want to log ssh traffic or not? If you want to log ssh traffic you could also do "pass in log quick" instead of "pass in log".

Maybe explain to me exactly what you want and I'll try to help some more.

[frisco]

Does $tcp_services include port 22? If so, remove it. That last pass in line will be matched last and so take precedence over the prior specific port 22 line. You could also add 'quick' to the port 22 specific line.

[phusion2k]

that's exactly what the problem was, port 22 was also included in the last line of my pf.conf file so it took precedence over the first rule, thanks elmore and frisco