Re: confusion with the pf filter rule syntax
From: Daniel Hartmeier (daniel_at_benzedrine.cx)
Date: 11/24/03
- Previous message: Sameer: "confusion with the pf filter rule syntax"
- In reply to: Sameer: "confusion with the pf filter rule syntax"
- Next in thread: Greg Hennessy: "Re: confusion with the pf filter rule syntax"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: 24 Nov 2003 07:20:05 GMT
On Mon, 24 Nov 2003 06:24:05 GMT, Sameer wrote:
> why do you need to state an interface as well as a source address? won't it
> suffice to simply state a source and a destination, thereby circumventing
> the "on int" portion?
If there are relations between source addresses of packets and interfaces
these packets pass in and out through, you'll have to express them in
rules to enforce them, pf doesn't detect (and enforce) such relations
otherwise (they don't exist in general).
If certain source (or destination) addresses just don't (or shouldn't)
occur on certain interfaces, people usually don't allow them with the
ruleset.
> outside interface, hme0 - 172.16.0.1
> inside interface, hme1 - 192.168.1.1
>
> can't you say,
>
> pass out from 192.168.1.1 proto tcp to any modulate state
This allows outgoing connections with source address 192.168.1.1
on both hme0 and hme1. If, for instance, you're running NAT and
translate all source addresses in 192.168.0.0/16 to 172.16.0.1
on hme0, you DON'T expect connections with source address
192.168.1.1 going out on hme0. Depends on whether hosts on
the internal network are using the firewall as gateway, and
whether it does NAT.
The rule is legal syntax, though, if that's what you meant.
You don't have to specify both 'on <if>' and 'to <addr>'
in each rule. But you may. If a rule doesn't specify 'on <if>',
it applies to all interfaces (including loopback and virtual
interfaces).
Daniel
- Previous message: Sameer: "confusion with the pf filter rule syntax"
- In reply to: Sameer: "confusion with the pf filter rule syntax"
- Next in thread: Greg Hennessy: "Re: confusion with the pf filter rule syntax"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|
