On Mon, Nov 04, 2013 at 04:33:29PM +0100, Marko Cupać wrote:
On Mon, 4 Nov 2013 16:05:38 +0100 Marc Sontowski <marc@xxxxxxxxxxxxx> wrote:# Pass all traffic to and from the local network, using quick so that later # rules are not evaluated if a packet match this. Some rulesets would restrict # local traffic much further pass quick on $int_if allAs comment says, quick keyword makes later rules being not evaluated if a packet match this. Try to add:pass in quick on $ext_if proto tcp from 192.168.2.0/24 to port www divert-to 127.0.0.1 port 3128above line that passes all quick on $int_if. -- Marko Cupać
Thanks Marko! my /etc/pf.conf looks like that now: --- # The internal interface (connected to the local network) ext_if="em0" # The external interfaces (connected to the ipv4 and ipv6 network) int_if="em1" ## Options set loginterface $ext_if set optimization aggressive # scrub incomming packets match on egress scrub (no-df) # Set the default policy to return RSTs or ICMPs for blocked traffic set block-policy drop # Ignore the loopback interface entirely set skip on lo0 anchor "ftp-proxy/*" pass in quick on $int_if inet proto tcp to any port ftp \ divert-to 127.0.0.1 port 8021 ## Translation rules # NAT traffic on the interface in the default egress interface group (to # which the interface out of which the default route goes is assigned) from the # local network match out on egress inet from $int_if:network to any nat-to (egress) ## Filtering rules # Default deny rule. which all blocked packets logged. block log all block in log on $ext_if all antispoof log for egress #squid transparent pass in quick on $ext_if proto tcp from 192.168.2.0/24 to port www divert-to 127.0.0.1 port 3128 pass out quick from 127.0.0.1 divert-reply # Pass all traffic to and from the local network, using quick so that later # rules are not evaluated if a packet match this. Some rulesets would restrict # local traffic much further pass out quick --- But it doesn't work :-( -- Marc Sontowski
Attachment:
pgpwBOMrvaqUS.pgp
Description: PGP signature
