Something went wrong on my new firewal, when I enabled PF, I couldn't access outside world (look like PF firewall blocked the access).
OK, hereis my PF:
Code:
#
# This ruleset is meant to work on a stateful firewall with a bridged DMZ
# network configured on the third NIC.
#
# .
#
###############################################################################
# Macros
#
# User-defined variables may be defined and used later, simplifying the
# configuration file. Macros must be defined before they are referenced.
#
# available interfaces
ext_if= "rl0"
int_if= "xl0"
dmz_if= "fxp0"
# list of networks
ext_net= "MY-REAL-IP/24"
int_net= "192.168.0.0/24"
# list of hosts
fw_ext= "MY-REAL-IP"
mail_dmz= "192.168.0.252"
web_dmz= "192.168.0.251"
###############################################################################
# Tables
#
# Tables provide a mechanism for increasing the performance and flexibility
# of rules with large numbers of source or destination addresses.
#
table <private> const { 127/8, 10/8, 172.16/12, 192.168/16 }
table <authpf_users> persist
###############################################################################
# Options
#
# Options tune the behaviour of the packet filtering engine.
#
set optimization normal
set block-policy drop
set skip on lo0
###############################################################################
# Traffic Normalization
#
# Traffic normalization protects internal machines against inconsistencies
# in Internet protocols and implementations.
#
scrub in
#scrub out
###############################################################################
# Translation
#
# Translation rules specify how addresses are to be mapped or redirected to
# other addresses.
#
# ftp-proxy anchors
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
# ip masquerading
nat on $ext_if inet from $int_net -> $fw_ext
# ftp-proxy
rdr pass on $int_if inet proto tcp to port 21 -> 127.0.0.1 port 8021
# reverse ftp-proxy (/usr/sbin/ftp-proxy -R x.x.x.3 -p 8022)
#rdr pass on $ext_if inet proto tcp to port 21 -> 127.0.0.1 port 8022
###############################################################################
# Packet Filtering
#
# Stateful and stateless packet filtering provides rule-based blocking or
# passing of packets.
#
# ftp-proxy anchor
anchor "ftp-proxy/*"
# default policy
block in log
block out
# trusted interfaces
pass in quick on $int_if inet
pass out quick on $int_if inet
# dmz interface
pass in quick on $dmz_if inet
#pass out quick on $dmz_if route-to lo0 inet proto tcp to port 8022
pass out quick on $dmz_if inet
# egress filtering
block out quick on $ext_if inet from !$ext_net
# anti-spoofing
block drop in quick on $ext_if inet from <private>
# outbound traffic (fw + int_net)
pass out on $ext_if inet proto { icmp, udp, tcp } from $fw_ext \
keep state
# outbound traffic (dmz)
pass out on $ext_if inet proto { udp, tcp } from !$fw_ext \
to port 53 keep state
# inbound traffic (fw)
pass in on $ext_if inet proto tcp to $fw_ext \
port 2222 flags S/SA keep state
# inbound traffic (mail)
pass in on $ext_if inet proto tcp to $mail_dmz \
port { 25, 53, 110 } flags S/SA keep state
pass in on $ext_if inet proto udp to $mail_dmz port 53 keep state
# inbound traffic (web)
pass in on $ext_if inet proto tcp to $web_dmz \
port { 21, 53, 80, 443 } flags S/SA keep state
pass in on $ext_if inet proto udp to $web_dmz port 53 keep state
# remote administration (authpf)
pass in on $ext_if inet proto tcp from <authpf_users> \
to { $mail_dmz, $web_dmz } port 22 flags S/SA keep state
Code:
#ifconfig rl0
rl0: flags=8943<UP,BROADCAST RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:e0:4c:a2:82:98
media: Ethernet autoselect (10baseT)
status: active
inet6 fe80::2e0:4cff:fea2:8298%rl0 prefixlen 64 scopeid 0x3
inet MY-REAL-IP netmask 0xffffff00 broadcast MY-REAL-IP.255
#ifconfig xl0
xl0: flags=8843<UP,BROADCAST RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:e0:4c:a2:82:98
media: Ethernet autoselect (10baseT)
status: active
inet6 fe80::2e0:4cff:fea2:8298%rl0 prefixlen 64 scopeid 0x1
inet 192.168.0.253 netmask 0xffffff00 broadcast 192.168.0.255
#ifconfig fxp0
fxp0: flags=8943<UP,BROADCAST RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:e0:4c:a2:82:98
media: Ethernet autoselect (10baseT)
status: active
inet6 fe80::2e0:4cff:fea2:8298%rl0 prefixlen 64 scopeid 0x2
inet 192.168.0.252 netmask 0xffffff00 broadcast 192.168.0.255
#ifconfig bridge0
bridge0: flags=41<UP,RUNNING> mtu 1500
groups: bridge
Look like I've been blocked from outside the world... any idea?
I've already check /etc/hosts, /etc/resolv.conf everything OK, if I turn off my PF filter...I can easly access outside the world..