working pf Asterisk configuration

2020-03-17 Thread David Mehler
Hello, I've got a 12.1 system with a jail. In this jail i'm wanting to run an Asterisk server. Does anyone have a working pf firewall configuration for a similar setup? Last time I attempted this I got 5060 to work, but there was no audio at all. Thanks. Dave.

Re: PF + IPsec

2020-03-17 Thread Cristian Cardoso
After some more research, I discovered a few things. The nat in the enc0 interface that you informed me was correct. The part I did not understand and did not know until now is that when the tunnel is / 24 to / 24 external routes do not enter into the route table of the setkey command. After discov

Re: PF + IPsec

2020-03-17 Thread Cristian Cardoso
I tried first that way you said, but it doesn't work, returned the expired ttl message in transit, when I try to run icmp from some host that is on a network outside freebsd, in my test only with the nat rule in enc0 Running tests from a host on another network, for example on the 10.7.8.0/24 netw

Re: PF + IPsec

2020-03-17 Thread Artem Viklenko via freebsd-pf
You don't need rdr nat on enc0 inet from 10.0.0.0/8 to 10.31.32.0/24 -> 10.19.12.251 On 17.03.20 14:35, Cristian Cardoso wrote: I tried as follows without success: rdr on xn0 inet proto icmp from 10.31.32.67 to 10.0.0.0/8 -> 10.19.12.251 nat on xn0 inet proto icmp from 10.0.0.0/8 to 10.31.32.

Re: PF + IPsec

2020-03-17 Thread Cristian Cardoso
I tried as follows without success: rdr on xn0 inet proto icmp from 10.31.32.67 to 10.0.0.0/8 -> 10.19.12.251 nat on xn0 inet proto icmp from 10.0.0.0/8 to 10.31.32.67/32 -> 10.19.12.251 rdr on enc0 inet proto icmp from 10.31.32.67 to 10.0.0.0/8 -> 10.19.12.251 nat on enc0 inet proto icmp from 10.