Changeset 10589 in hybrid for branches/releng-9.0

Timestamp:

Apr 26, 2012, 2:01:09 PM (13 years ago)

Author:

rick

Message:

Split hybrid and special proxy setup, as the proxy setup is highly custom and
somehow exotic, not useable in the hybrid setup (due to the gateway pain).

Location:

branches/releng-9.0/nanobsd/files/etc

Files:

• pf.hybrid.conf (modified) (4 diffs)
• pf.proxy.conf (copied) (copied from branches/releng-9.0/nanobsd/files/etc/pf.hybrid.conf ) (2 diffs)

branches/releng-9.0/nanobsd/files/etc/pf.hybrid.conf

@@ -12 +12 @@
 # 6) WL Captive Portal Support for interfaces who needs it.
 # 7) Optional: Exposure of WL services to the outside
-# 8) Overrides default route for local orginating traffic to specific ports, needed for
-#    for normal proxy setup, which should NOT follow the iLeiden default route.
 # 9) Protect the Wireless Network from junk traffic.
 #
@@ -29 +27 @@
 ext_if="vr0"
 ext_if_net="vr0:network"
-ext_if_default_route="192.168.42.1"
 captive_portal_interfaces="wlan0"
 publicnat="http,https"
 masterip="127.0.0.1"
-# For an traditional proxy setup set, uncomment:
+# For an traditional proxy setup set (no iLeiden clients!), uncomment:
 #publicnat=0
 
@@ -51 +48 @@
 nat on $ext_if inet proto tcp from $wl_net to any port { $ileiden_ports } -> ($ext_if) 
 
-# Nat to the internet for packets which are orginating from itself for proxy functionality (8)
-nat on !$ext_if inet proto tcp from $wl_net to any port { $ileiden_ports } -> ($ext_if) 
-
 # Redirect some internal facing services outside, please mind also need allow rules (bottom of file) (7)
 rdr on $ext_if inet proto tcp from any to $ext_if port 8081 -> 172.16.4.46 port 80
@@ -66 +60 @@
 # By default all interfaces are open (5)
 pass all
-
-# This quirck is needed to override the routing table default route (8) 
-pass out on !$ext_if route-to ($ext_if $ext_if_default_route) proto tcp from any to !$wl_net port {22, 80, 443} user != unknown keep state
-pass out on !$ext_if route-to ($ext_if $ext_if_default_route) proto udp from any to !$wl_net port {53} user != unknown keep state
 
 # By default deny all outgoing traffic to avoid systems spamming the network (9)

branches/releng-9.0/nanobsd/files/etc/pf.proxy.conf

@@ -29 +29 @@
 ext_if="vr0"
 ext_if_net="vr0:network"
-ext_if_default_route="192.168.42.1"
+ext_if_gw="127.127.127.127"
 captive_portal_interfaces="wlan0"
 publicnat="http,https"
@@ -68 +68 @@
 
 # This quirck is needed to override the routing table default route (8) 
-pass out on !$ext_if route-to ($ext_if $ext_if_default_route) proto tcp from any to !$wl_net port {22, 80, 443} user != unknown keep state
-pass out on !$ext_if route-to ($ext_if $ext_if_default_route) proto udp from any to !$wl_net port {53} user != unknown keep state
+pass out on !$ext_if route-to ($ext_if $ext_if_gw) proto tcp from any to !$wl_net port {22, 80, 443} user != unknown keep state
+pass out on !$ext_if route-to ($ext_if $ext_if_gw) proto udp from any to !$wl_net port {53} user != unknown keep state
 
 # By default deny all outgoing traffic to avoid systems spamming the network (9)