Re: PF Question/Help

On Tue, Dec 24, 2024 at 02:26:18AM +0100, Markus Wernig wrote:
>On 12/23/24 19:31, Jon Fineman wrote:
>
>>third sub net ($wired3) (10.0.3.x) I would like to restrict traffic between it
>>and the ISP. Clients on 10.0.3.x should not be able to access the
>>other sub nets.
>
>Take a look at the rules from your pf.conf:
>
>> block out quick from $wired3 to { $wired1 $wired2 }
>
>and what they get translated to:
>
>> block drop out quick inet from 10.0.3.1 to 10.0.1.1
>> block drop out quick inet from 10.0.3.1 to 10.0.2.1
>
>So apparently $wired1 $wired2 are not the network behind them, but
>only the interface itself, as is $wired3.
>
>You might want:
>
>block quick from em3:network to { em1:network em2:network }
>
>instead.
>
>best /m
>

I haven't been able to get that to work. And I have triple checked I
am plugged in to the correct ports.

In addition I changed my rules a bit to restrict to just ipv4 to
simplify things a bit.

So a snippet of the change is:

block quick from em3:network to { em1:network em2:network }
pass out quick inet from $wired3 to $isp
pass in on { $isp $wired1 $wired2 $wired3 } inet
pass out inet from { $isp $wired1 $wired2 }



And the pfctl output is:

block drop all
block drop quick inet from 10.0.3.0/24 to 10.0.1.0/24
block drop quick inet from 10.0.3.0/24 to 10.0.2.0/24
pass out quick inet from 10.0.3.1 to 10.0.0.99 flags S/SA
pass in on em0 inet all flags S/SA
pass in on em1 inet all flags S/SA
pass in on em2 inet all flags S/SA
pass in on em3 inet all flags S/SA
pass out inet from 10.0.0.99 to any flags S/SA
pass out inet from 10.0.1.1 to any flags S/SA
pass out inet from 10.0.2.1 to any flags S/SA