handling local traffic

Thread View: bit.listserv.openbsd-pf

2 messages

[T] Back to Threads [V] Tree View [G] Group Articles

2 total messages Started by Justin Murdock Mon, 30 Jan 2012 13:09

#206

Author: Justin Murdock
Date: Mon, 30 Jan 2012 13:09

21 lines
1591 bytes

OpenBSD 4.9 GENERIC.MP#819 amd64

I'm not quite sure when things changed, but I can no longer apply rules 
to locally originating traffic:
     match in log on lo

now only logs local->local traffic and
     match out log received-on lo

logs nothing. The best I can do, it seems, is to
     match in tag "EXTERNAL"
     match out log tagged ""

More worrying for me, however, is the inability to control traffic being 
received by the host. I want to be able to

     pass on $dmz to port {http, https, ssh}
     block out on lo
     pass out on lo from <trusted> to port ssh

I feel I must be missing something, I'm just not sure what.

Re: handling local traffic

#207

Author: Justin Murdock
Date: Mon, 30 Jan 2012 14:07

28 lines
2005 bytes

I've been thinking about this for months (on and off) but as soon as I 
send the email a solution occurs to me. Typical.

On 30/01/2012 12:31, Justin Murdock wrote:
> OpenBSD 4.9 GENERIC.MP#819 amd64
>
> I'm not quite sure when things changed, but I can no longer apply 
> rules to locally originating traffic the following doesn't work as I 
> would wish]:
>
>     match out log received-on lo
I can, however, catch this traffic using
     match out log user != unknown

>
>     pass on $dmz to port {http, https, ssh}
>     block out on lo
>     pass out on lo from <trusted> to port ssh
>
similarly becomes:
     pass on $dmz to port {http, https, ssh}
     block in user != unknown
     pass in from <trusted> to port ssh user != unknown

> I feel I must be missing something, I'm just not sure what.
I'm not entirely comfortable with this - especially as the "... in ... 
user != unknown" construction depends on there being a listening socket 
- which could be quite interesting with the rdr-to interactions.

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads