[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

surfing from behind the firewall, pf rules



Hello all,
Windows XP / Windows 2000 / OpenBSD systems behind a OpenBSD 3.2-stable
firewall with PF.
During "heavy web surfing sessions", especially when loading a lot over a
slower (90Kbps link)... I see my "block in rule" stopping a few packets from
port 80 servers.
A good example is a web page like this:
http://forums.fark.com/cgi/fark/comments.pl?IDLink=363417 from a Windows XP
SP1 client.  On that particular page, each image is loaded from a different
server, so you have a lot of connections going out from a single machine to
multiple servers.
Outbound Surfing rules
===============================
The OpenBSD FAQ currently suggests:
# and let out-going traffic out and maintain state on established
connections
# pass out all protocols, including TCP, UDP and ICMP, and create state,
# so that external DNS servers can reply to our own DNS requests (UDP).
block out log on $ExtIF                 all
pass  out on $ExtIF inet proto tcp  all flags S/SA keep state
pass  out on $ExtIF inet proto udp  all            keep state
pass  out on $ExtIF inet proto icmp all            keep state
Is this still the "ideal" config for pf on OpenBSD 3.2?  Isn't the "shorter
form" now:
# and let out-going traffic out and maintain state on established
connections
# pass out all protocols, including TCP, UDP and ICMP, and create state,
# so that external DNS servers can reply to our own DNS requests (UDP).
block out log on $ExtIF all
pass  out     on $ExtIF all keep state
Or am I giving something up?
FYI: In the same section, the openbsd.org FAQ still says use "pfctl -R
/etc/pf.conf" to update rules, the new 3.2 syntax is "pfctl -R -f
/etc/pf.conf" correct?  Can someone feed that to appropriate person who
maintains FAQ.
My Rules
====================
ExtIF="tun0"            # External Interface
ExtIFIP="(tun0)"        # External Interface IP Address
IntIF1="fxp0"           # Internal Interface 1
IntIF2="wi0"            # Internal Interface 2 wireless
IntNet1="192.168.148.0/24"   # Our internal network Ethernet
IntNet2="192.168.146.0/24"   # Our internal network Wireless
NoRouteIPs="{ 0.0.0/32, 127.0.0.1/8, 192.168.0.0/16, 172.16.0.0/12,
10.0.0.0/8 }"
Services="{ www, https }"
scrub in all
nat on $ExtIF from $IntNet1  to any -> $ExtIFIP
nat on $ExtIF from $IntNet2  to any -> $ExtIFIP
block in  log quick on $ExtIF from $NoRouteIPs to any
block out log quick on $ExtIF from any         to $NoRouteIPs
block in  log       on $ExtIF                  all
# only allow our inside interface  to connect via ssh
pass  in on $IntIF1 inet proto tcp from $IntNet1 to any port 22 \
        flags S/SA keep state
pass  in on $IntIF2 inet proto tcp from $IntNet2 to any port 22 \
        flags S/SA keep state
# are we hosting any servers?
# allow others to use http and https
pass  in on $ExtIF inet proto tcp from any to any port $Services \
      flags S/SA keep state
block out log on $ExtIF all
pass  out     on $ExtIF all keep state
As for the blocks when surfing web sites.  They are always port 80 traffic
going to my clients from servers they are surfing.  I see hits on my rule
#11 (block in log on $ExtIF all).  These are signs that my rule #17 (pass
out on $ExtIF all keep state) is not always keeping state?  Servers with
problems?
Block examples from log:
Nov 26 07:02:37.572369 rule 11/0(match): block in on tun0: 216.77.188.41.80
> 166.154.128.190.55349: R 2093:2093(0) ack 1 win 0
Nov 26 07:03:08.300311 rule 11/0(match): block in on tun0: 66.79.10.212.80 >
166.154.128.190.56084: . 0:1460(1460) ack 1 win 17520 (DF)
Nov 26 07:04:11.700187 rule 11/0(match): block in on tun0: 66.79.10.212.80 >
166.154.128.190.56084: . 0:1460(1460) ack 1 win 17520 (DF)
Nov 26 07:05:16.044624 rule 11/0(match): block in on tun0: 66.79.10.212.80 >
166.154.128.190.56084: . 0:1460(1460) ack 1 win 17520 (DF)
Nov 26 07:06:20.042119 rule 11/0(match): block in on tun0: 66.79.10.212.80 >
166.154.128.190.56084: . 0:1460(1460) ack 1 win 17520 (DF)
Nov 26 07:07:23.641847 rule 11/0(match): block in on tun0: 66.79.10.212.80 >
166.154.128.190.56084: . 0:1460(1460) ack 1 win 17520 (DF)
Nov 26 07:08:28.045226 rule 11/0(match): block in on tun0: 66.79.10.212.80 >
166.154.128.190.56084: . 0:1460(1460) ack 1 win 17520 (DF)
Nov 26 07:09:32.072133 rule 11/0(match): block in on tun0: 66.79.10.212.80 >
166.154.128.190.56084: . 0:1460(1460) ack 1 win 17520 (DF)
Nov 26 07:10:36.052234 rule 11/0(match): block in on tun0: 66.79.10.212.80 >
166.154.128.190.56084: . 0:1460(1460) ack 1 win 17520 (DF)
Nov 26 07:11:40.082263 rule 11/0(match): block in on tun0: 66.79.10.212.80 >
166.154.128.190.56084: . 0:1460(1460) ack 1 win 17520 (DF)
Nov 26 07:12:43.517003 rule 11/0(match): block in on tun0: 66.79.10.212.80 >
166.154.128.190.56084: R 4891:4891(0) ack 1 win 17520 (DF)
My web browser (Internet Explorer) on the Windows XP box is still requesting
one of the graphics to load from the HTML on
http://forums.fark.com/cgi/fark/comments.pl?IDLink=363417 page.
Thank you.
  Stephen Gutknecht
  currently in Port Orchard, Washington USA