[datamike]

Hi everyone. Here is my problem. I have OpenBSD 3.1 running as a bridge. Two NIC's with no IP adresses. I took the basic idea from the write up on this site.

My bridge is up and I can forward just fine. If is put pass all in my pf.conf I can get through it so I know it is working but I have something wrong with my ruleset.

ext_if= "sis0"
int_if= "sis1"

pass in quick on $ext_if
pass out quick on $ext_if

#filter on internal nic

block in log on $int_if all


pass out on $int_if proto udp all keep state
pass out on $int_if proto tcp all modulate state
pass out on $int_if inet proto icmp all icmp-type 8 code 0 keep state

I don't reall y get the last one either. I can't get out to the web, mail server, or anything.
This is a home network so I don't host any HTTP, FTP, or mail coming in. I only need access out and nothing in for now. I want it as simple as I can get it for now and then as I learn more I will make it more complex. Can anyone see what is wrong, tell me what I should add or take out. Thanks in advance.

[elmore]

You're blocking on the internal interface. You should be blocking on the external interface, Also your pass in quick pass out quick isn;t really providing you a lot of protection.

I would try a ruleset more like this:



# $OpenBSD: pf.conf,v 1.2 2001/06/26 22:58:31 smart Exp $
# Variable Expansion to keep things clean and neat
ExtIF="{ xl0 }"
NoRouteIPs="{2.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
# Clean up fragmented and abnormal packets
scrub in all
# don't allow anyone to spoof non-routeable addresses
block in quick on $ExtIF inet from $NoRouteIPs to any
block out quick on $ExtIF inet from any to $NoRouteIPs
# finally lock the rest down with a default deny
block in quick on $ExtIF from any to any
# and let out-going traffic out and maintain state on established #connections
pass out on $ExtIF from any to any keep state


For more info see these posts:

http://screamingelectron.org/phpBB2/viewtopic.php?t=28
http://screamingelectron.org/phpBB2/viewtopic.php?t=45&postdays=0&postorder=asc&start= 0

[bsdjunkie]

One thing to remember on bridges for those of you using them. Only Filter on one Interface, not both, or your in for a world of trouble unless you really know what your doing :roll:

[datamike]

OK I will try blocking on the ext nic but what should I have for the $int_if? Do I need something in there?

[bsdjunkie]

see my above post :P