> On Friday 08 January 2010 06:04:34 Peter wrote: >> iH, >> Playing around with FIBs and jails. >> >> The host system is on a private 172.xxx network with a gateway of >> 172.xxx >> going through a NAT box for internet. [fib 0] >> >> The jail has only a public IP, on fib 1 [with gateway being ISP router] >> >> With this, the jail is working fine. >> >> What I'm trying to accomplish is portknocking for 'ssh' access: >> >> pass in log quick proto tcp from any to any port {1234} synproxy state \ >> (max-src-conn-rate 5/15, overload <portknock_ssh>) >> >> Because the jail is on 'fib 1', the connection is never established to >> overload the rule. The 'synproxy state' is communicating via the >> 172.xxxx/default gateway [of fib 0] instead of via the public "fib 1" >> >> I can ssh into the jail if I do >> pass in log quick proto tcp from any to any port {22} keep state >> >> I CANNOT ssh into the jail if I do >> pass in log quick proto tcp from any to any port {22} synproxy state >> >> Anyway I can force 'synproxy' to communicate via fib 1 ? > > I don't think I understand your setup and intent completely, but you can > select a fib with the "rtable" filter parameter. It *should* be used for > the > synproxy communication, as well. Please report if this helps. > > -- > Max >
host: 172.xxx -> gateway = 172.xxx.1 [NAT] -> 216.241.167.YY [fib 0/default] jail: 216.241.167.XX -> gateway = 216.241.167.1 [jail started on fib 1] fib0: gateway = 172.xxx.1 [host] fib1: gateway = 216.241.167.1 [jail] With jail on fib 1, and different gateway vs. the host system itself, 'synproxy' does not work. With rtable, I'm still NOT able to connect to jail from outside: pass in log quick proto tcp from any to any port = ssh synproxy state rtable 1 [/sbin/pfctl -nf /etc/pf.conf && /sbin/pfctl -f /etc/pf.conf] If I remove 'synproxy state' and put in 'keep state' it works. FreeBSD stable/8 ]Peter[ _______________________________________________ freebsd-pf@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-pf To unsubscribe, send any mail to "freebsd-pf-unsubscr...@freebsd.org"