Configure pf Firewall - Revision history

imported>Jacob: /* WAN → LAN */

2019-06-05T16:52:38Z

WAN → LAN

← Older revision		Revision as of 11:52, 5 June 2019
Line 34:		Line 34:

	The return traffic will go out through the earlier defined lan to wan routes using the client_out rules i.e.:		The return traffic will go out through the earlier defined lan to wan routes using the client_out rules i.e.:
			<small>pass in on $int_if proto tcp from $localnet to port $client_out
			pass out on $ext_if proto tcp from ($ext_if) to !($ext_if) port $client_out queue (q_def, q_pri)</small>
	<br>		<br>
	<br>		<br>
	* [[Setup pf.conf file]]		* [[Setup pf.conf file]]

imported>Jacob: /* WAN → LAN */

2019-06-05T16:51:56Z

WAN → LAN

← Older revision		Revision as of 11:51, 5 June 2019
Line 23:		Line 23:
	For the WAN to LAN we have to make a few considerations. If for instance the redirect rule is used with pass like so:		For the WAN to LAN we have to make a few considerations. If for instance the redirect rule is used with pass like so:
	<small>rdr pass on $ext_if proto tcp to $ext_if port $web_ports -> $web_server</small>		<small>rdr pass on $ext_if proto tcp to $ext_if port $web_ports -> $web_server</small>
	The return traffic will then go through the default queue. and not through for instance the web queue. Therefore a ~~separate~~ rdr and a pass rule will be used, like this.		The return traffic will then go through the default queue and not through, for instance, the web queue. Therefore a different rdr and a pass rule will be used, like this.
	<small>rdr on $ext_if proto tcp to $ext_if port $web_ports -> $web_server		<small>rdr on $ext_if proto tcp to $ext_if port $web_ports -> $web_server
	pass in on $ext_if proto tcp from any to $web_server port $web_ports queue (q_web, q_pri)</small>		pass in on $ext_if proto tcp from any to $web_server port $web_ports queue (q_web, q_pri)</small>
Line 33:		Line 33:
	So traffic is now flowing into WAN NIC through the firewall out of the LAN NIC.<br>		So traffic is now flowing into WAN NIC through the firewall out of the LAN NIC.<br>

	The return traffic will ~~need~~ to ~~be taken care of~~. ~~These~~		The return traffic will go out through the earlier defined lan to wan routes using the client_out rules i.e.:

	<br>		<br>
	<br>		<br>
	* [[Setup pf.conf file]]		* [[Setup pf.conf file]]

imported>Jacob: /* WAN → LAN */

2019-06-05T16:39:08Z

WAN → LAN

← Older revision		Revision as of 11:39, 5 June 2019
Line 21:		Line 21:
	This could have been just one rule each by combining the ports of client and apps. However this setup provides the opportunity to easily change the priority for one of these traffic classes at a later stage.		This could have been just one rule each by combining the ports of client and apps. However this setup provides the opportunity to easily change the priority for one of these traffic classes at a later stage.
	=== WAN → LAN ===		=== WAN → LAN ===
	~~The above gives use~~ a few ~~challenges~~. If for instance ~~we use~~ the redirect rule with pass like so:		For the WAN to LAN we have to make a few considerations. If for instance the redirect rule is used with pass like so:
	<small>rdr pass on $ext_if proto tcp to $ext_if port $web_ports -> $web_server</small>		<small>rdr pass on $ext_if proto tcp to $ext_if port $web_ports -> $web_server</small>
	The return traffic will then go through the default queue. and not through for instance the web queue. ~~We therefore will have~~ a rdr and a pass rule like this.		The return traffic will then go through the default queue. and not through for instance the web queue. Therefore a separate rdr and a pass rule will be used, like this.
	<small>rdr on $ext_if proto tcp to $ext_if port $web_ports -> $web_server		<small>rdr on $ext_if proto tcp to $ext_if port $web_ports -> $web_server
	pass in on $ext_if proto tcp from any to $web_server port $web_ports queue (q_web, q_pri)</small>		pass in on $ext_if proto tcp from any to $web_server port $web_ports queue (q_web, q_pri)</small>

imported>Jacob at 16:36, 5 June 2019

2019-06-05T16:36:46Z

← Older revision		Revision as of 11:36, 5 June 2019
Line 1:		Line 1:
			=== Overview ===
	The philosophy we will use for the fire wall is that we split in 2 or 4 steps depending on if the traffic initiated outside WAN or RED side or the inside LAN or GREEN.<br>		The philosophy we will use for the fire wall is that we split in 2 or 4 steps depending on if the traffic initiated outside WAN or RED side or the inside LAN or GREEN.<br>
	First of all we use a private network range on the LAN side. So we will need to use NAT to be able to communicate from the LAN to the WAN.		First of all we use a private network range on the LAN side. So we will need to use NAT to be able to communicate from the LAN to the WAN.

imported>Jacob at 16:36, 5 June 2019

2019-06-05T16:36:09Z

← Older revision		Revision as of 11:36, 5 June 2019
Line 19:		Line 19:
	With the 2nd 2 rules traffic flows out of the firewall over the default queue using the WAN NIC.<br>		With the 2nd 2 rules traffic flows out of the firewall over the default queue using the WAN NIC.<br>
	This could have been just one rule each by combining the ports of client and apps. However this setup provides the opportunity to easily change the priority for one of these traffic classes at a later stage.		This could have been just one rule each by combining the ports of client and apps. However this setup provides the opportunity to easily change the priority for one of these traffic classes at a later stage.
	~~<br>~~		=== WAN → LAN ===
	~~<br>~~
	The above gives use a few challenges. If for instance we use the redirect rule with pass like so:		The above gives use a few challenges. If for instance we use the redirect rule with pass like so:
	<small>rdr pass on $ext_if proto tcp to $ext_if port $web_ports -> $web_server</small>		<small>rdr pass on $ext_if proto tcp to $ext_if port $web_ports -> $web_server</small>

imported>Jacob at 14:51, 5 June 2019

2019-06-05T14:51:23Z

← Older revision		Revision as of 09:51, 5 June 2019
Line 7:		Line 7:
	Lets start with the LAN → WAN traffic first.<br>		Lets start with the LAN → WAN traffic first.<br>
	By using macros we are able to use only a few rules for a lot of different traffic. The major split used here is:		By using macros we are able to use only a few rules for a lot of different traffic. The major split used here is:
	<small>		<small>client_out ports, i.e. http, https
	client_out ports, i.e. http, https		apps_out ports i.e. Dyn updater, Razor, dccproc</small>
	apps_out ports i.e. Dyn updater, Razor, dccproc
	</small>
	A NAT rule is required to facilitate the private network range ip addresses.		A NAT rule is required to facilitate the private network range ip addresses.
	<small>		<small>nat on $ext_if inet from $localnet to any -> ($ext_if)</small>
	nat on $ext_if inet from $localnet to any -> ($ext_if)
	</small>
	These will allow to have only 2 rules one at the LAN NIC and one at the WAN NIC.		These will allow to have only 2 rules one at the LAN NIC and one at the WAN NIC.
	<small>		<small>pass in on $int_if proto tcp from $localnet to port $apps_out
	pass in on $int_if proto tcp from $localnet to port $apps_out
	pass in on $int_if proto tcp from $localnet to port $client_out		pass in on $int_if proto tcp from $localnet to port $client_out
	pass out on $ext_if proto tcp from ($ext_if) to !($ext_if) port $apps_out queue (q_def, q_pri)		pass out on $ext_if proto tcp from ($ext_if) to !($ext_if) port $apps_out queue (q_def, q_pri)
	pass out on $ext_if proto tcp from ($ext_if) to !($ext_if) port $client_out queue (q_def, q_pri)		pass out on $ext_if proto tcp from ($ext_if) to !($ext_if) port $client_out queue (q_def, q_pri)</small>
	</small>
	With the 1st 2 rules traffic flows into firewall over the LAN NIC.<br>		With the 1st 2 rules traffic flows into firewall over the LAN NIC.<br>
	With the 2nd 2 rules traffic flows out of the firewall over the default queue using the WAN NIC.<br>		With the 2nd 2 rules traffic flows out of the firewall over the default queue using the WAN NIC.<br>

imported>Jacob at 14:50, 5 June 2019

2019-06-05T14:50:34Z

imported>Jacob at 14:49, 5 June 2019

2019-06-05T14:49:32Z

← Older revision		Revision as of 09:49, 5 June 2019
Line 9:		Line 9:
	client_out ports, i.e. http, https		client_out ports, i.e. http, https
	apps_out ports i.e. Dyn updater, Razor, dccproc		apps_out ports i.e. Dyn updater, Razor, dccproc
			A NAT rule is required to facilitate the private network range ip addresses.
			nat on $ext_if inet from $localnet to any -> ($ext_if)
	These will allow to have only 2 rules one at the LAN NIC and one at the WAN NIC.		These will allow to have only 2 rules one at the LAN NIC and one at the WAN NIC.
	pass in on $int_if proto tcp from $localnet to port $apps_out		pass in on $int_if proto tcp from $localnet to port $apps_out

imported>Jacob at 14:46, 5 June 2019

2019-06-05T14:46:02Z

← Older revision		Revision as of 09:46, 5 June 2019
Line 4:		Line 4:
	The fact that we use a private network range, also mean we have only one public available IP address to which all traffic initiated on the WAN wil be send. We therefore need to redirect the external traffic to the right host.<br>		The fact that we use a private network range, also mean we have only one public available IP address to which all traffic initiated on the WAN wil be send. We therefore need to redirect the external traffic to the right host.<br>
	Furthermore we use queues to prioritise traffic, so our web side will be responsive and video will not be hampered by a large file transfer. Queues work on the WAN interface for the LAN → WAN traffic.<br>		Furthermore we use queues to prioritise traffic, so our web side will be responsive and video will not be hampered by a large file transfer. Queues work on the WAN interface for the LAN → WAN traffic.<br>
	== LAN → WAN ==		=== LAN → WAN ===
	Lets start with the LAN → WAN traffic first.<br>		Lets start with the LAN → WAN traffic first.<br>
	By using macros we are able to use only a few rules for a lot of different traffic. The major split used here is:		By using macros we are able to use only a few rules for a lot of different traffic. The major split used here is:

imported>Jacob at 14:45, 5 June 2019

2019-06-05T14:45:48Z

← Older revision		Revision as of 09:45, 5 June 2019
Line 4:		Line 4:
	The fact that we use a private network range, also mean we have only one public available IP address to which all traffic initiated on the WAN wil be send. We therefore need to redirect the external traffic to the right host.<br>		The fact that we use a private network range, also mean we have only one public available IP address to which all traffic initiated on the WAN wil be send. We therefore need to redirect the external traffic to the right host.<br>
	Furthermore we use queues to prioritise traffic, so our web side will be responsive and video will not be hampered by a large file transfer. Queues work on the WAN interface for the LAN → WAN traffic.<br>		Furthermore we use queues to prioritise traffic, so our web side will be responsive and video will not be hampered by a large file transfer. Queues work on the WAN interface for the LAN → WAN traffic.<br>
			== LAN → WAN ==
	Lets start with the LAN → WAN traffic first.<br>		Lets start with the LAN → WAN traffic first.<br>
	By using macros we are able to use only a few rules for a lot of different traffic. The major split used here is:		By using macros we are able to use only a few rules for a lot of different traffic. The major split used here is:

← Older revision		Revision as of 09:50, 5 June 2019
Line 7:		Line 7:
	Lets start with the LAN → WAN traffic first.<br>		Lets start with the LAN → WAN traffic first.<br>
	By using macros we are able to use only a few rules for a lot of different traffic. The major split used here is:		By using macros we are able to use only a few rules for a lot of different traffic. The major split used here is:
			<small>
	client_out ports, i.e. http, https		client_out ports, i.e. http, https
	apps_out ports i.e. Dyn updater, Razor, dccproc		apps_out ports i.e. Dyn updater, Razor, dccproc
			</small>
	A NAT rule is required to facilitate the private network range ip addresses.		A NAT rule is required to facilitate the private network range ip addresses.
			<small>
	nat on $ext_if inet from $localnet to any -> ($ext_if)		nat on $ext_if inet from $localnet to any -> ($ext_if)
			</small>
	These will allow to have only 2 rules one at the LAN NIC and one at the WAN NIC.		These will allow to have only 2 rules one at the LAN NIC and one at the WAN NIC.
			<small>
	pass in on $int_if proto tcp from $localnet to port $apps_out		pass in on $int_if proto tcp from $localnet to port $apps_out
	pass in on $int_if proto tcp from $localnet to port $client_out		pass in on $int_if proto tcp from $localnet to port $client_out
	pass out on $ext_if proto tcp from ($ext_if) to !($ext_if) port $apps_out queue (q_def, q_pri)		pass out on $ext_if proto tcp from ($ext_if) to !($ext_if) port $apps_out queue (q_def, q_pri)
	pass out on $ext_if proto tcp from ($ext_if) to !($ext_if) port $client_out queue (q_def, q_pri)		pass out on $ext_if proto tcp from ($ext_if) to !($ext_if) port $client_out queue (q_def, q_pri)
			</small>
	With the 1st 2 rules traffic flows into firewall over the LAN NIC.<br>		With the 1st 2 rules traffic flows into firewall over the LAN NIC.<br>
	With the 2nd 2 rules traffic flows out of the firewall over the default queue using the WAN NIC.<br>		With the 2nd 2 rules traffic flows out of the firewall over the default queue using the WAN NIC.<br>