On Fri, Dec 07, 2007 at 06:20:37AM -0600, ajtiM wrote: > Hi! > > I am a new FreeBSD 7.0 beta3 user and I have standalone computer connected to > the internet (cable). I use both, console and KDE desktop. I tried to setup > PF firewall for the standalone computer but I have a problem with internal > messages (mail) which are blocked if firewall running. > This is from /var/log/mail: > "sm-msp-queue[15113]: lB493C1i007320: to=root, ctladdr=root (0/0), > delay=1+21:37:55, xdelay=00:00:00, mailer=relay, pri > =2552408, relay=[127.0.0.1], dsn=4.0.0, stat=Deferred: Operation not > permitted" > > My pf.conf looks like: > > pass out quick inet from (sk0) to any keep state label "RULE 0 -- ACCEPT " > block drop in quick inet all label "RULE 1 -- DROP " > block drop out quick inet all label "RULE 1 -- DROP " > block drop in quick inet all label "RULE 10000 -- DROP " > block drop out quick inet all label "RULE 10000 -- DROP "
You're dropping all incoming traffic, also on the local interface! Try adding: set skip on lo furthermore, your ruleset has duplicates, especially since you use the quick keyword. Below is a commented example a pf.conf for a workstation (mine :-) -------------------- /etc/pf.conf --------------------- # /etc/pf.conf # Macros: define common values, so they can be referenced and changed easily. ext_if = "rl0" int_if = "rl1" # Addresses that can't be routed externally. # See http://www.rfc-editor.org/rfc/rfc3330.txt # (10.0.0.138 is my router, so it should be reachable!) table <unroutable> const { 0.0.0.0/8, 10.0.0.0/8, !10.0.0.138, 127.0.0.0/8, \ 169.254.0.0/16, 172.16.0.0/12, 192.0.2.0/24, 192.168.0.0/16, 240.0.0.0/4 } # Options: tune the behavior of pf. set optimization normal set block-policy drop set loginterface $ext_if set skip on lo # Normalization: reassemble fragments etc. scrub in all # Translate outgoing packets' source addresses (any protocol). # In this case, any address but the gateway's external address is mapped. # The sysctl net.inet.ip.forwarding should be set for this to work. # Alternatively, set gateway_enable="YES" in /etc/rc.conf. nat pass on $ext_if inet from $int_if:network to any -> $ext_if # Filtering antispoof quick for $int_if # Nobody gets in from the outside! block in log quick on $ext_if all label "inblock" # Block packets to unroutable addresses block out log quick on $ext_if from any to <unroutable> label "unroutable" # Block by default. block out log on $ext_if all label "outblock" # Internal "network" is trusted. pass in on $int_if all # Let outgoing traffic through, and keep state # 'modulate state' only works with TCP! pass out on $ext_if inet proto tcp all flags S/SA modulate state pass out on $ext_if inet proto udp all keep state # Let pings through. pass out on $ext_if inet proto icmp all icmp-type 8 code 0 keep state -------------------- /etc/pf.conf --------------------- HTH, Roland -- R.F.Smith http://www.xs4all.nl/~rsmith/ [plain text _non-HTML_ PGP/GnuPG encrypted/signed email much appreciated] pgp: 1A2B 477F 9970 BA3C 2914 B7CE 1277 EFB0 C321 A725 (KeyID: C321A725)
pgpNW39Glm2bb.pgp
Description: PGP signature
