Re: Firewall setup

2024-04-16 Thread Michel von Behr
May I suggest relaying these more basic questions to @rookies mail-list? I think it would be great if we could have this channel reactivated, dedicated to help folks like Karel learn how to navigate more basic stuff, and keep misc@ for intermediary / advanced users inquiries. On Wed, 17 Apr 2024 a

Re: Firewall setup

2024-04-16 Thread Daniel Ouellet
On 4/16/24 10:27 AM, Karel Lucas wrote: First and most importantly, I would like to apologize to anyone who was disturbed by my conversation. It is not my intention to offend people. I may be curt, but that's not because it's in my character. In daily life I work with electronics and computer

Re: Firewall setup

2024-04-16 Thread Karel Lucas
This is my dmesg, if anyone is interested: OpenBSD 7.4 (GENERIC.MP) #3: Wed Feb 28 06:23:33 MST 2024 r...@syspatch-74-amd64.openbsd.org:/usr/src/sys/arch/amd64/compile/GENERIC.MP real mem = 4047122432 (3859MB) avail mem = 3904729088 (3723MB) random: good seed from bootblocks mpath0 at root scs

Re: Firewall setup

2024-04-16 Thread Karel Lucas
First and most importantly, I would like to apologize to anyone who was disturbed by my conversation. It is not my intention to offend people. I may be curt, but that's not because it's in my character. In daily life I work with electronics and computers and am much less familiar with networks.

Re: Firewall setup

2024-04-16 Thread Zé Loff
On Tue, Apr 16, 2024 at 12:01:38AM +0200, Karel Lucas wrote: > > Op 15-04-2024 om 22:20 schreef Peter N. M. Hansteen: > > On Mon, Apr 15, 2024 at 10:09:31PM +0200, Karel Lucas wrote: > > > This gives the following error messages when booting: > > > no IP address found for igc1:network > > > /etc

Re: Firewall setup

2024-04-15 Thread Peter N. M. Hansteen
I give up. The obviously incomplete, hand edited ifconfig output shows three interfaces that are (or appear to be, judging from the excerpts that we are given) not configured with IP addresses, two of which have a link, while the last does not. For reasons unknown these three are joined in a thre

Re: Firewall setup

2024-04-15 Thread Stuart Henderson
On 2024-04-15, Karel Lucas wrote: > /etc/hostname.bridge0: > add igc0 add igc1 add igc2 blocknonip igc0 blocknonip igc1 blocknonip > igc2 up bridging with PF is an advanced topic, please get familiar with PF on a standard routed firewall first -- Please keep replies on the mailing list.

Re: Firewall setup

2024-04-15 Thread Karel Lucas
Op 15-04-2024 om 22:20 schreef Peter N. M. Hansteen: On Mon, Apr 15, 2024 at 10:09:31PM +0200, Karel Lucas wrote: This gives the following error messages when booting: no IP address found for igc1:network /etc/pf.conf:41: could not parse host specification no IP address found for igc2:network

Re: Firewall setup

2024-04-15 Thread Karel Lucas
That's a possibility I hadn't thought of yet. But how do I do that, and on which page can I find that in your book? Op 15-04-2024 om 22:17 schreef Peter N. M. Hansteen: The other option - if your network layout is such that it makes sense to treat them to the same rule criteria - would be to ma

Re: Firewall setup

2024-04-15 Thread Karel Lucas
Op 14-04-2024 om 21:57 schreef Jens Kaiser: Hello Karel, if you want to start simply, then I would recommend to remove all marcos from your pf.conf which are not referenced. You can add them later if needed. As already state by others, there is a syntax error in marco martians. If there are sy

Re: Firewall setup

2024-04-15 Thread Peter N. M. Hansteen
On Mon, Apr 15, 2024 at 10:09:31PM +0200, Karel Lucas wrote: > This gives the following error messages when booting: > no IP address found for igc1:network > /etc/pf.conf:41: could not parse host specification > no IP address found for igc2:network > /etc/pf.conf:42: could not parse host specificat

Re: Firewall setup

2024-04-15 Thread Peter N. M. Hansteen
On Mon, Apr 15, 2024 at 10:01:59PM +0200, Karel Lucas wrote: > They both give a syntax error by booting. > > Op 14-04-2024 om 17:45 schreef Zé Loff: > > pass in on $int_if proto udp to port 53 > > pass in on $int_if proto udp to $nameservers port 53 You're not giving us a lot to work wi

Re: Firewall setup

2024-04-15 Thread Karel Lucas
This gives the following error messages when booting: no IP address found for igc1:network /etc/pf.conf:41: could not parse host specification no IP address found for igc2:network /etc/pf.conf:42: could not parse host specification Op 14-04-2024 om 19:59 schreef Peter N. M. Hansteen: On Sun, Ap

Re: Firewall setup

2024-04-15 Thread Karel Lucas
They both give a syntax error by booting. Op 14-04-2024 om 17:45 schreef Zé Loff: pass in on $int_if proto udp to port 53 pass in on $int_if proto udp to $nameservers port 53

Re: Firewall setup

2024-04-14 Thread deich...@placebonol.com
I'm a long time network engineer/firewall admin/make things work on our network when it is broken. First, ICMP Echo Request ( "ping" ) works, you proved that when you sent an Echo Request to a host using it's IP address. The fact that DNS host resolution fails has nothing to do with ICMP Echo

Re: Firewall setup

2024-04-14 Thread Sean Kamath
> On Apr 14, 2024, at 08:09, Karel Lucas wrote: > > Hi all, Hi. > So let's start simple and then proceed step by step. I want to continue with > ping so that I can test the connection to the internet. This works: ping -c > 10 195.121.1.34. But this doesn't work: ping -c 10 www.apple.com. A

Re: Firewall setup

2024-04-14 Thread Jens Kaiser
Hello Karel, if you want to start simply, then I would recommend to remove all marcos from your pf.conf which are not referenced. You can add them later if needed. As already state by others, there is a syntax error in marco martians. If there are syntax errors in pf.conf, the rules are not loade

Re: Firewall setup

2024-04-14 Thread Peter N. M. Hansteen
On Sun, Apr 14, 2024 at 05:09:01PM +0200, Karel Lucas wrote: > Hi all, > > Everything about PF is all very confusing to me at the moment, so any help > is appreciated. So let's start simple and then proceed step by step. I want > to continue with ping so that I can test the connection to the inter

Re: Firewall setup

2024-04-14 Thread Michael Lambert
There is a typo on the second line of the martians definition (spurious comma and space). Michael > On Apr 14, 2024, at 11:09, Karel Lucas wrote: > > Hi all, > > Everything about PF is all very confusing to me at the moment, so any help is > appreciated. So let's start simple and then procee

Re: Firewall setup

2024-04-14 Thread Zé Loff
On Sun, Apr 14, 2024 at 05:09:01PM +0200, Karel Lucas wrote: > Hi all, > > Everything about PF is all very confusing to me at the moment, so any help > is appreciated. So let's start simple and then proceed step by step. I want > to continue with ping so that I can test the connection to the inter

Firewall setup

2024-04-14 Thread Karel Lucas
Hi all, Everything about PF is all very confusing to me at the moment, so any help is appreciated. So let's start simple and then proceed step by step. I want to continue with ping so that I can test the connection to the internet. This works: ping -c 10 195.121.1.34. But this doesn't work: p

active-active firewall setup

2010-02-17 Thread Kapetanakis Giannis
I've setup successfully a pair of 4.7-current obsd load balanced firewall/routers I'd like some clarification on the manual page of carp(4). from carp(4): "If IP balancing is being used on a firewall, it is recommended to config- ure the carpnodes in a >>symmetrical<< manner. This is achieved

Re: Routing errors in dual pf/carp firewall setup (no route to host)

2006-11-11 Thread Edward Aronyk
On 11/9/06, Chad M Stewart <[EMAIL PROTECTED]> wrote: Can you send the output of netstat -rn? Maybe that'll help myself and others a little more. -Chad Of course - sorry I forgot to do this in the first place. Looking at this output it's clear I need to add some routes - but I don't know what

Re: Routing errors in dual pf/carp firewall setup (no route to host)

2006-11-09 Thread Chad M Stewart
Can you send the output of netstat -rn? Maybe that'll help myself and others a little more. -Chad

Routing errors in dual pf/carp firewall setup (no route to host)

2006-11-08 Thread Edward Aronyk
Good day all, I have read all available documentation, but can not seem to find the solution to my problem. If anyone has any advice, or can point me towards a good resource, it would be appreciated. I am sorry if the answer is obvious and I have missed it. Where I work we have a small network (

fault tolerant bridging firewall setup

2006-03-04 Thread Curtis H. Wilbar Jr.
I'm attempting to get a bridging firewall setup going... with two servers rigged as a fault tolerant pair. CARP of course won't work in this setup... as I'm not sharing an IP. So... I'm using spanning tree protocol. so... graphically: Firew