Changeset 10578 in hybrid


Ignore:
Timestamp:
Apr 26, 2012, 10:56:04 AM (13 years ago)
Author:
rick
Message:

Brain gymnastics to get the local originating packets for a default proxy setup
to go the right way (out on the ext interface, instead of the following default
route).

Downside is that I explicitly need to know the default gateway, as lvrouted is
rewriting it for the iLeiden setup.

Related-To: nodefactory#129

File:
1 edited

Legend:

Unmodified
Added
Removed
  • branches/releng-9.0/nanobsd/files/etc/pf.hybrid.conf

    r10523 r10578  
    1010# 6) WL Captive Portal Support for interfaces who needs it.
    1111# 7) Optional: Exposure of WL services to the outside
    12 #
     12# 8) Overrides default route for local orginating traffic to specific ports, needed for
     13#    for normal proxy setup, which should NOT follow the iLeiden default route.
    1314wl_net="172.16.0.0/12"
    1415allow_ext_tcp="{ssh, domain}"
     
    2122ext_if="vr0"
    2223ext_if_net="vr0:network"
     24ext_if_default_route="192.168.42.1"
    2325captive_portal_interfaces="wlan0"
    2426publicnat="http,https"
     
    3638nat on ! $ext_if from $ext_if_net to $wl_net -> $masterip
    3739
    38 # Nat the internet but NOT to Private Network (1)
    39 nat on $ext_if inet proto tcp from $wl_net to any port { $publicnat } -> ($ext_if)
    4040# Do NOT allow NAT to the Private Network (3)
    41 no nat on $ext_if from $wl_net to $private
     41no nat from $wl_net to $private
     42
     43# Nat the internet for iLeiden functionality (1)
     44nat on $ext_if inet proto tcp from $wl_net to any port { 80,443 } -> ($ext_if)
     45
     46# Nat to the internet for packets which are orginating from itself for proxy functionality (8)
     47nat on !$ext_if inet proto tcp from $wl_net to any port { 80,443 } -> ($ext_if)
     48
    4249
    4350# Redirection needs source natting and allow rules (see below) (7)
     
    5360# By default all interfaces are open (5)
    5461pass all
     62
     63# This quirck is needed to override the routing table default route (8)
     64pass out on !$ext_if route-to ($ext_if $ext_if_default_route) proto tcp from any to !$wl_net port {22, 80, 443} user != unknown keep state
     65pass out on !$ext_if route-to ($ext_if $ext_if_default_route) proto udp from any to !$wl_net port {53} user != unknown keep state
    5566
    5667# External interface is permissive (4)
Note: See TracChangeset for help on using the changeset viewer.