On Mon, Nov 04, 2013 at 07:33:18PM +0100, Marko Cupać wrote:
Before we dive deeper into this, let's clarify: - Do you have OpenBSD as a gateway to the Internet?
Yes
- Are your physical interfaces named em0 and em1?
Yes
- Is em0 connected to LAN, em1 to your ISP?
em0 = ISP em1 = LAN
- Can you ping some public IP address from OpenBSD box?
Yes
- Can you browse the Web through OpenBSD gateway without adding proxy redirect rule?
Yes. My pf.conf looks like that without the added proxy rule(s): # The internal interface (connected to the local network) ext_if="em0" # The external interfaces (connected to the ipv4 and ipv6 network) int_if="em1" ## Options set loginterface $ext_if set optimization aggressive # scrub incomming packets match on egress scrub (no-df) # Set the default policy to return RSTs or ICMPs for blocked traffic set block-policy drop # Ignore the loopback interface entirely set skip on lo0 anchor "ftp-proxy/*" pass in quick on $int_if inet proto tcp to any port ftp \ divert-to 127.0.0.1 port 8021 ## Translation rules # NAT traffic on the interface in the default egress interface group (to # which the interface out of which the default route goes is assigned) from the # local network match out on egress inet from $int_if:network to any nat-to (egress) ## Filtering rules # Default deny rule. which all blocked packets logged. block log all block in log on $ext_if all antispoof log for egress # Pass all traffic to and from the local network, using quick so that later # rules are not evaluated if a packet match this. Some rulesets would restrict # local traffic much further pass quick on $int_if all # Permit all traffic going out, keep state so that replies are # automatically passed many rulesets would have many rules here, # restricting traffic in an out on the external (egress) interface. # (keep state is not needed on the newest version of pf) pass out quick ------- Thank you Marko for patience with me!!!! -- Marc Sontowski
Attachment:
pgppWn5FzQXAN.pgp
Description: PGP signature
