Pessoal eu estava querendo fazer alguns testes aqui com o PF + altq
mas olha so o que esta acontecendo..
%pfctl -vvv -f /etc/pf.conf
Loaded 293 passive OS fingerprints
int_if = "lo0"
ext_if = "sis0"
tcp_services = "{ 22000, 21000, 8000 }"
icmp_types = "echoreq"
priv_nets = "{ 127.0.0.0/8, 192.168.1.1 }"
set block-policy drop
@0 scrub in all fragment reassemble
@1 block drop all
@2 pass quick on lo0 all
@3 block drop in quick on sis0 inet from 127.0.0.0/8 to any
@4 block drop in quick on sis0 inet from 192.168.1.1 to any
@5 block drop out quick on ext_if inet from any to 127.0.0.0/8
@6 block drop out quick on ext_if inet from any to 192.168.1.1
/etc/pf.conf:17: unknown protocol tcp
warning: macro 'icmp_types' not used
pfctl: Syntax error in config file: pf rules not loaded
alguem pode me ajudar?
meu /etc/pf.conf esta assim
# Macros
int_if = "lo0"
ext_if = "sis0"
tcp_services = "{ 22000, 21000, 8000 }"
icmp_types = "echoreq"
priv_nets = "{ 127.0.0.0/8, 192.168.1.1 }"
set block-policy drop
scrub in all
# Regras de Filtragem
block all
pass quick on $int_if all
block drop in quick on $ext_if from $priv_nets to any
block drop out quick on ext_if from any to $priv_nets
pass in log on $ext_if inet proto tcp from any to $ext_if port
$tcp_services flags S/SA keep state
#pass in log on $ext_if inet proto tcp from port 20 to $ext_if user
proxy flags S/SA keep state
#pass in log inet proto icmp all icmp-type $icmp_types keep state
#pass out on $ext_if proto tcp all modulate state flags S/SA
#pass out on $ext_if proto { udp, icmp } all keep state
conpilei o kernel com as seguintes opcoes...
#PF
device pf
device pflog
device pfsync
options ALTQ
options ALTQ_CBQ
options ALTQ_RED
options ALTQ_RIO
options ALTQ_HFSC
options ALTQ_CDNR
options ALTQ_PRIQ
#ipfw
options IPFIREWALL
options IPFIREWALL_VERBOSE
options DUMMYNET
options IPFIREWALL_FORWARD
options IPFIREWALL_VERBOSE_LIMIT=10
t+
-------------------------
Histórico: http://www.fug.com.br/historico/html/freebsd/
Sair da lista: https://www.fug.com.br/mailman/listinfo/freebsd
