Changeset 10578 in hybrid for branches

Timestamp:

Apr 26, 2012, 10:56:04 AM (13 years ago)

Author:

rick

Message:

Brain gymnastics to get the local originating packets for a default proxy setup
to go the right way (out on the ext interface, instead of the following default
route).

Downside is that I explicitly need to know the default gateway, as lvrouted is
rewriting it for the iLeiden setup.

Related-To: nodefactory#129

File:

• branches/releng-9.0/nanobsd/files/etc/pf.hybrid.conf (modified) (4 diffs)

branches/releng-9.0/nanobsd/files/etc/pf.hybrid.conf

@@ -10 +10 @@
 # 6) WL Captive Portal Support for interfaces who needs it.
 # 7) Optional: Exposure of WL services to the outside
-#
+# 8) Overrides default route for local orginating traffic to specific ports, needed for
+#    for normal proxy setup, which should NOT follow the iLeiden default route.
 wl_net="172.16.0.0/12"
 allow_ext_tcp="{ssh, domain}"
@@ -21 +22 @@
 ext_if="vr0"
 ext_if_net="vr0:network"
+ext_if_default_route="192.168.42.1"
 captive_portal_interfaces="wlan0"
 publicnat="http,https"
@@ -36 +38 @@
 nat on ! $ext_if from $ext_if_net to $wl_net -> $masterip
 
-# Nat the internet but NOT to Private Network (1)
-nat on $ext_if inet proto tcp from $wl_net to any port { $publicnat } -> ($ext_if) 
 # Do NOT allow NAT to the Private Network (3)
-no nat on $ext_if from $wl_net to $private
+no nat from $wl_net to $private
+
+# Nat the internet for iLeiden functionality (1)
+nat on $ext_if inet proto tcp from $wl_net to any port { 80,443 } -> ($ext_if) 
+
+# Nat to the internet for packets which are orginating from itself for proxy functionality (8)
+nat on !$ext_if inet proto tcp from $wl_net to any port { 80,443 } -> ($ext_if) 
+
 
 # Redirection needs source natting and allow rules (see below) (7)
@@ -53 +60 @@
 # By default all interfaces are open (5)
 pass all
+
+# This quirck is needed to override the routing table default route (8) 
+pass out on !$ext_if route-to ($ext_if $ext_if_default_route) proto tcp from any to !$wl_net port {22, 80, 443} user != unknown keep state
+pass out on !$ext_if route-to ($ext_if $ext_if_default_route) proto udp from any to !$wl_net port {53} user != unknown keep state
 
 # External interface is permissive (4)