Re: need help with pf configuration

2011-10-10 Thread Victor Sudakov
Matthew Seaman wrote: > > > > > > I need no details, just a general hint how to setup such security > > > > levels, preferably independent of actual IP addressses behind the > > > > interfaces (a :network macro is not always sufficient). > >>> > > > >>> > > You may use urpf-failed

Re: need help with pf configuration

2011-10-10 Thread Patrick Lamaiziere
Le Mon, 10 Oct 2011 14:10:53 +0700, Victor Sudakov a écrit : > The problem is, there could be several routed networks behind the > inside interfaces. Not all inside networks are directly connected, and > the :network macro works only for directly connected interfaces, > right? Rigth, this is why

Re: need help with pf configuration

2011-10-10 Thread Victor Sudakov
Nikos Vassiliadis wrote: > >> > >>>I have a configuration with 2 inside interfaces, 1 outside and 1 dmz > >>>interface. The traffic should be able to flow > >>> > >>>1) from inside1 to any (and back) > >>>2) from inside2 to any (and back) > >>>3) from dmz to outside only (and back). > >>> > >>>I ne

Re: need help with pf configuration

2011-10-10 Thread Victor Sudakov
Matthew Seaman wrote: > > > > > > I need no details, just a general hint how to setup such security > > > > levels, preferably independent of actual IP addressses behind the > > > > interfaces (a :network macro is not always sufficient). > >>> > > > >>> > > You may use urpf-failed

Re: need help with pf configuration

2011-10-09 Thread Victor Sudakov
Patrick Lamaiziere wrote: > > > > > I need no details, just a general hint how to setup such security > > > > levels, preferably independent of actual IP addressses behind the > > > > interfaces (a :network macro is not always sufficient). > > > > > > You may use urpf-failed instead :network > >

Re: need help with pf configuration

2011-10-09 Thread Nikos Vassiliadis
On 10/9/2011 10:39 AM, Victor Sudakov wrote: Patrick Lamaiziere wrote: I have a configuration with 2 inside interfaces, 1 outside and 1 dmz interface. The traffic should be able to flow 1) from inside1 to any (and back) 2) from inside2 to any (and back) 3) from dmz to outside only (and back).

Re: need help with pf configuration

2011-10-09 Thread Matthew Seaman
On 09/10/2011 10:31, Patrick Lamaiziere wrote: > Le Sun, 9 Oct 2011 14:39:10 +0700, > Victor Sudakov a écrit : > > > > I need no details, just a general hint how to setup such security > > > levels, preferably independent of actual IP addressses behind the > > > interfaces (a :netw

Re: need help with pf configuration

2011-10-09 Thread Patrick Lamaiziere
Le Sun, 9 Oct 2011 14:39:10 +0700, Victor Sudakov a écrit : > > > I need no details, just a general hint how to setup such security > > > levels, preferably independent of actual IP addressses behind the > > > interfaces (a :network macro is not always sufficient). > > > > You may use urpf-faile

Re: need help with pf configuration

2011-10-09 Thread Victor Sudakov
Patrick Lamaiziere wrote: > > > I have a configuration with 2 inside interfaces, 1 outside and 1 dmz > > interface. The traffic should be able to flow > > > > 1) from inside1 to any (and back) > > 2) from inside2 to any (and back) > > 3) from dmz to outside only (and back). > > > > I need no det

Re: need help with pf configuration

2011-10-08 Thread Patrick Lamaiziere
Le Sun, 9 Oct 2011 12:15:54 +0700, Victor Sudakov a écrit : > I have a configuration with 2 inside interfaces, 1 outside and 1 dmz > interface. The traffic should be able to flow > > 1) from inside1 to any (and back) > 2) from inside2 to any (and back) > 3) from dmz to outside only (and back). >

need help with pf configuration

2011-10-08 Thread Victor Sudakov
Colleagues, I have a configuration with 2 inside interfaces, 1 outside and 1 dmz interface. The traffic should be able to flow 1) from inside1 to any (and back) 2) from inside2 to any (and back) 3) from dmz to outside only (and back). I need no details, just a general hint how to setup such secu