Learning how to pf "right" P2
Dennis Steinkamp <[email protected]> Fri, 15 May 2015 17:33:00 +0200
| Newsgroups | gmane.os.openbsd.pf |
|---|---|
| Message-ID | <[email protected]> |
--------------020506050204060900030009
Content-Type: text/plain; charset="utf-8"; format=flowed
Content-Transfer-Encoding: 7bit
Hey there,
so now i reached chapter 7 of the book and from reading through the
different chapters in it, i came up with
the following little Pf Script. (still work in progress of course^^)
*# I. MACROS**
**# --------------*
ext_if = "vlan100" # External interface macro
int_if = "vlan200" # Internal interface macro
int_net = $int_if:network # Internal network macro
icmp_types = "echoreq"
#
*# II. TABLES**
**# -------------*
table <aliens> { 127.0.0.0/8, 192.168.0.0/16, \
172.16.0.0/12, 10.0.0.0/8, \
169.254.0.0/16, 192.0.2.0/24, \
0.0.0.0/8, 240.0.0.0/4 }
#
*# II. FILTERING**
**# -----------------*
a.) block all /# Default block in/out rule/
b.) set skip on lo /# Skip any filtering on loopback/
c.) match out on egress inet from $int_net nat-to egress /# NAT from
$int_net to $ext_if (ext_if=egress)/
d.) pass inet proto icmp from $int_net icmp-type $icmp_types /# Pass
icmp traffic (echoreq) from $int_net/
e.) pass in on $int_if from $int_net to any /# Pass traffic from
$int_net coming in on $int_if to any (Pass to firewall itself)/
f.) pass out on egress from egress to any /# Pass traffic from $ext_if
(extif_egress) going out on $ext_if to any //
//# //(Pass to the "world" outside of the firewall itself)/
g.) block in quick on $ext_if from <aliens> to any /# Block private
address space coming in on $ext_if to any/
h.) block out quick on $ext_if from any to <aliens> /# Block from any
going out on $ext_if to private address space/
i.) antispoof for $ext_if /# Enable antispoof on $ext_if/
j.) antispoof for $int_if /# Enable antispoof on $int_if/
What i want to accomplish is rather easy i suppose.
Block everything by default and just let my OpenBSD machine act as a
gateway for my $int_net.
No services need to be reachable from the "outside world", even no ssh.
Apart from that, its just about taking a few security measures as
recommended by the book (so far) and mentioned here on the mailing list.
Of course i got a few questions to ask, as you probably could have
guessed already ;)
_*
My questions are:*_
1.) Does it make sense to make use of rules *g-h* while at the same time
enabling antispoofing in *i-j*?
As far as my understanding goes *g-h* and *i-j* are more or less trying
to achieve the same thing, aren`t they?
2.) I would like to add packet prioritization to the existing rulset for
certain client machines like for example:
All internet related traffic for client A should be proritized over
internet related traffic for client B.
I assume i can do this by refering to the ip address of the client in a
rule and then /set prio/ accordingly.
Another approach would be to create different vlan interfaces and assign
all traffic coming in on that interface with different priorities
globally. In the scenario above for $int_if i would have to /set prio x/
on rule e.) to prioritize traffic globally, is that correct? (that would
include traffic that needs to cross between interfaces/subnets also right?)
Doing it on the IP address of the client machine doesn`t seem very
clever because, even though they could be assigned statically by DHCP,
they are easy to set manually.
3.) How do i scrub with Pf in OpenBSD 5.7?
The book says /match in all scrub (no-df max-mss 1440)/ but i don`t
understand the mss 1440.
I am on a ADSL2 (PPPoE) connection 16Mbps DS/1.8Mbps US)
Thank you again for your time and of course i am always interested how
to improve my ruleset if any of the stuff above seems bogus. :)
Regards
Dennis
--------------020506050204060900030009
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-MIME-Autoconverted: from 8bit to quoted-printable by insomnia.benzedrine.ch id t4FLU4Zi007488
<html>
<head>
<meta http-equiv=3D"content-type" content=3D"text/html; charset=3Dutf=
-8">
</head>
<body bgcolor=3D"#FFFFFF" text=3D"#000000">
Hey there,<br>
<br>
so now i reached chapter 7 of the book and from reading through the
different chapters in it, i came up with <br>
the following little Pf Script. (still work in progress of course^^)<=
br>
<small><br>
<b># I. MACROS</b><b><br>
</b><b># --------------</b><br>
ext_if =3D "vlan100" # External interface macro<br>
int_if =3D "vlan200" # Internal interface macro<br>
int_net =3D $int_if:network # Internal network macro<br>
icmp_types =3D "echoreq"<br>
#<br>
<b># II. TABLES</b><b><br>
</b><b># -------------</b><br>
table <aliens> { 127.0.0.0/8, 192.168.0.0/16, \<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0 172.16.0.0/12, 10.0.0.0/8, \<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0 169.254.0.0/16, 192.0.2.0/24, \<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0 0.0.0.0/8, 240.0.0.0/4 }<br>
#<br>
<b># II. FILTERING</b><b><br>
</b><b># -----------------</b><br>
a.) block all=C2=A0 <i># Default block in/out rule</i><br>
b.) set skip on lo=C2=A0 <i># Skip any filtering on loopback</i><br=
>
c.) match out on egress inet from $int_net nat-to egress <i># NAT
from $int_net to $ext_if (ext_if=3Degress)</i><br>
d.) pass inet proto icmp from $int_net icmp-type $icmp_types <i>#
Pass icmp traffic (echoreq) from $int_net</i><br>
e.) pass in on $int_if from $int_net to any <i># Pass traffic
from $int_net coming in on $int_if to any (Pass to firewall
itself)</i><br>
f.) pass out on egress from egress to any <i># Pass traffic from
$ext_if (extif_egress) going out on $ext_if to any </i><i><br>
</i><i># </i><i>(Pass to the "world" outside of the firewall
itself)</i><br>
g.) block in quick on $ext_if from <aliens> to any <i>#
Block private address space coming in on $ext_if to any</i><br>
h.) block out quick on $ext_if from any to <aliens> <i>#
Block from any going out on $ext_if to private address space</i><=
br>
i.) antispoof for $ext_if <i># Enable antispoof on $ext_if</i><br>
j.) antispoof for $int_if=C2=A0 <i># Enable antispoof on $int_if</i=
></small><br>
<br>
What i want to accomplish is rather easy i suppose.<br>
Block everything by default and just let my OpenBSD machine act as a
gateway for my $int_net.<br>
No services need to be reachable from the "outside world", even no
ssh. <br>
Apart from that, its just about taking a few security measures as
recommended by the book (so far) and mentioned here on the mailing
list.<br>
Of course i got a few questions to ask, as you probably could have
guessed already ;)<br>
<u><b><br>
My questions are:</b></u><br>
1.) Does it make sense to make use of rules <b>g-h</b> while at the
same time enabling antispoofing in <b>i-j</b>? <br>
As far as my understanding goes <b>g-h</b> and <b>i-j</b> are more
or less trying to achieve the same thing, aren`t they?<br>
<br>
2.) I would like to add packet prioritization to the existing rulset
for certain client machines like for example:<br>
All internet related traffic for client A should be proritized over
internet related traffic for client B.<br>
I assume i can do this by refering to the ip address of the client
in a rule and then <i>set prio</i> accordingly.<br>
Another approach would be to create different vlan interfaces and
assign all traffic coming in on that interface with different
priorities globally. In the scenario above for $int_if i would have
to <i>set prio x</i> on rule e.) to prioritize traffic globally, is
that correct? (that would include traffic that needs to cross
between interfaces/subnets also right?)<br>
Doing it on the IP address of the client machine doesn`t seem very
clever because, even though they could be=C2=A0 assigned statically b=
y
DHCP, they are easy to set manually.<br>
<br>
3.) How do i scrub with Pf in OpenBSD 5.7? <br>
The book says <i>match in all scrub (no-df max-mss 1440)</i> but i
don`t understand the mss 1440.<br>
I am on a ADSL2 (PPPoE) connection 16Mbps DS/1.8Mbps US)<br>
<br>
Thank you again for your time and of course i am always interested
how to improve my ruleset if any of the stuff above seems bogus. :)<b=
r>
<br>
Regards<br>
<br>
Dennis<br>
<br>
</body>
</html>
--------------020506050204060900030009--