Re: pf question: "no rdr" problem, upgraded 4.2->4.7

2010-07-15 Thread Peter N. M. Hansteen
David Hardy writes: > no rdr on $cus inet proto tcp from to any port www > > we use a web cache, but want to exempt some clients from being transparently > proxied to it. the quick escape is likely just that - an appropriately placed pass quick or match quick with the appropriate rdr-to, depend

Re: pf question: "no rdr" problem, upgraded 4.2->4.7

2010-07-15 Thread John Cosimano
--- David Hardy [Thu, Jul 15, 2010 at 12:09:07PM -0600]: --- > I'm upgrading a obsd firewall/router to 4.7 from 4.2 and am having to make > all kinds of changes, but one I can't figure out is why it's choking on: > > no rdr on $cus inet proto tcp from to any port www > > we use a web cache, but

pf question: "no rdr" problem, upgraded 4.2->4.7

2010-07-15 Thread David Hardy
I'm upgrading a obsd firewall/router to 4.7 from 4.2 and am having to make all kinds of changes, but one I can't figure out is why it's choking on: no rdr on $cus inet proto tcp from to any port www we use a web cache, but want to exempt some clients from being transparently proxied to it. what

Re: RDR problem

2010-06-18 Thread Alessandro Baggi
Hi there. There were different errors on the last email. For the first rdr-to I have lost the direction, and for the second rule host specification, the same with different host. But today, reading these mail, I've another question: the rdr-to rules does not accept only inbound packet? thank

Re: RDR problem

2010-06-18 Thread Stuart Henderson
On 2010-06-17, Alessandro Baggi wrote: > Hi stuart. Thanks for the reply. Can you give me a valid example to > understand this directive? > Reading man pages and on the web I understand that with match directive, > the quick keyword has no durable effect, and the match directive set on > the fl

Re: RDR problem

2010-06-17 Thread Alessandro Baggi
Hi stuart. Thanks for the reply. Can you give me a valid example to understand this directive? Reading man pages and on the web I understand that with match directive, the quick keyword has no durable effect, and the match directive set on the fly the values e not after last rule match such as p

Re: RDR problem

2010-06-17 Thread Stuart Henderson
"match" is a modifier. the settings are remembered and applied to the pass rule lower in the ruleset which permits the traffic to go through. On 2010-06-17, Alessandro Baggi wrote: > Hi misc. > I've a openbsd 4.7 firewall with 3 nic, one for lan, one for wan and one > for dmz. On the same mach

RDR problem

2010-06-17 Thread Alessandro Baggi
Hi misc. I've a openbsd 4.7 firewall with 3 nic, one for lan, one for wan and one for dmz. On the same machine I've a squid proxy, and in dmz i've a web server. My problem is when I get a request for the web server on dmz by a lan client. In my ruleset I've this rdr rules for http request: ma

Re: pf rdr problem [Solved]

2006-02-26 Thread Reid Nichol
Thanks for the tcpdump switches. I don't know what was going on with the switches that I was using, but when I used yours, I started to get debugging info, which revealed some strange behaviour. >From there I started to re-read (again) the docs and found and tried TCP Proxying which worked like a

Re: pf rdr problem

2006-02-26 Thread Stuart Henderson
On 2006/02/26 14:13, Reid Nichol wrote: > > inet -- andrew -- xander > | > users > > Everything is working, NAT, RDR for the other stuff, just not the web > server. I've tried some variations for rdr used rdr pass, etc, but > nothing in the log

pf rdr problem

2006-02-26 Thread Reid Nichol
Hello: I've been trying to diagnose this problem for some time and I can't even get debugging info out of this box. I'm really thinking that I'm missing something simple, but can't see it for the trees. Here's the setup. inet -- andrew -- xander | ---