[Junky]

Hi,

I am fairly new to OpenBSD (3.3 CD) and could do with a little advice regarding PF. Here is my setup:

ISP
|
|
Cable Modem
|
|
| [W]
Linksys Router
| [L]
|
P1----------DMZ
P2----------XBOX (yes, i know)
P3----------[vr0] OpenBSD-PF [xl0]---------------[I] Browsing Machine
P4
P5

Where:
[W] = DHCP assigned by ISP
[L] = 192.168.1.1/255.255.255.0
[vr0] = 192.168.1.4/255.255.255.0
[xl0] = 172.16.0.1/255.255.255.0
[I] = 172.16.0.2/255.255.255.0

So the OpenBSD machine has /etc/mygate of 192.168.1.1.
Basically the 'Browsing Machine' is a tri-boot of Windows, OpenBSD and FreeBSD which I am using to learn on. I also want this machine to be as secure as possible in case I do something silly during my experiments!

I know it would probably be easier to make vr0 dhcp and plug straight into the Cable Modem, but this would mean having to have extra noisy machine (and more heat) powered up when I am using xbox-live. Also it appears the linksys router provides basic filtering.

Don't worry, I am coming onto the problem(s) shortly!...

Anyway, I brought a copy of Michael Lucas's book "Absolute OpenBSD" and after some heavy copying (!) I had:


For /etc/pf.conf:

# /etc/pf.conf
#

# MACROS
int_if = "xl0"
ext_if = "vr0"

# TABLES
table <illegal_in> file "/etc/pf_illegal_ip_in"
table <illegal_out> file "/etc/pf_illegal_ip_out"

# OPTIONS
set block-policy drop
set loginterface $ext_if
#set loginterface $int_if
set optimization normal

# TRAFFIC NORMALISATION
scrub in all

# BANDWIDTH MANAGEMENT
#

# TRANSLATION
#

# REDIRECTION
#

# PACKET FILTERING

# Block everything
block drop in all
block drop out all

# Stop all IPv6 traffic
block drop in log quick inet6 all
block drop out log quick inet6 all

# Prevent spoofing of non-routable addresses
block drop in log quick on $ext_if from <illegal_in>
block drop in log quick on $int_if from <illegal_out>

# Antispoof all interfaces
antispoof log for vr0
antispoof log for xl0
antispoof log for lo0

# Pass everything on loopback (lo0)
pass in quick on lo0 all
pass out quick on lo0 all

# Disrupt port scanners
block in quick proto tcp all flags SF/SFRA
block in quick proto tcp all flags SFUP/SFRAU
block in quick proto tcp all flags FPU/SFRAUP
block in quick proto tcp all flags /SFRA
block in quick proto tcp all flags F/SFRA
block in quick proto tcp all flags U/SFRAU
# block in quick proto tcp all flags P

# Allow valid network tarffic in and out
pass in on $int_if from 172.16.0.2 to any modulate state
pass out on $ext_if proto tcp to any port { www, https } modulate state flags S/SAFR
pass out on $ext_if proto { udp, icmp } all keep state


And /etc/pf_illegal_ip_in:

# /etc/pf_illegal_ip_in
#
224.0.0.0/3
10.0.0.0/8
127.0.0.0/8
0.0.0.0/8
172.16.0.0/12
192.168.0.0/16
169.254.0.0/16
204.152.64.0/23
192.0.2.0/24
255.255.255.255/32
!192.168.1.1


And /etc/pf_illegal_ip_out:

# /etc/pf_illegal_ip_out
#
224.0.0.0/3
10.0.0.0/8
127.0.0.0/8
0.0.0.0/8
172.16.0.0/12
192.168.0.0/16
169.254.0.0/16
204.152.64.0/23
192.0.2.0/24
255.255.255.255/32
!172.16.0.2

Ok, the rules are loaded as shown above, but I have a couple of problems:-

1. #set loginterface $int_if

Only one interface seems to be logged by PF (shown by pfctl -s
info) For instance, if I uncomment the above line then xl0 is
logged but vr0 is no longer logged? I know it is not really needed,
but how can I log all the interfaces?

2. I copied the rules to 'confuse' port scanner's straight out of Michael
Lucas's book and to be honest, I have took them as read.
However if I uncomment the line:

# block in quick proto tcp all flags P

Then PF complains of an error in this line - something is wrong but
I do not understand what?

3. I get confusing results when I try to test the firewall, which I am
pretty sure is to do with having the Linksys router in the way (ie
this is doing things to data too).

From: http://www.grc.com - Shields Up
Shows: All ports show as stealth except IDENT (113) is shown
as closed

From: http://scan.sygatetech.com - TCP scan
Shows: All ports show as stealth except IDENT (113) AND WEB
(80) are shown as closed???

[Both run from my browsing machine]

The thing is if I disable PF I get the same results.
I suppose this means that my PF rules aren't doing anything and I
am just seeing results from router (which has very little to
configure)? Still the two web sites also show inconsistencies???


Can anyone help with any of these things - especially if my rules are even
valid - I'd sure be grateful and it would give me a bit of confidence!!!

[SolarfluX]

The first thing you should do is check the pf-tips section of the pf-repository for some hints on how to streamline and eliminate some of the cruft from your pf.conf. While 'Absolute OpenBSD' will no doubt be a good starting point, it was written before certain new features of PF were implemented. One of which is, using 'scrub' eliminates the need for 'antiportscan' rules with various TCP flag combinations (SF/SFRA, et al)...

https://solarflux.org/pf/pf-tips

After you read those and revise your pf.conf, test again and then report back with your findings.

Another thing is to have someone you know run nmap (or even Nessus) against your OpenBSD box with various combinations and report the results to you. Those third-party sites are ok as general advice, but as you have seen, you're getting different results.

Try this one, which uses the nmap default (-sS) scan:

http://crypto.yashy.com/nmap.php

[Junky]

SolarfluX - thanks for your reply.

I'll check out the pf-tips and try to write something more streamlined in the next day or so. I guess because it was my first pf.conf attempt, I didn't want to miss anything, but probably got a little bit carried away!

Anyway, I'll let you know how I get on.

Cheers
Junky

[Junky]

I am so stupid! Did some further research and most of my questions
have already been answered on this forum or in pf-faq. Doh!!!

I will definitely research my questions more thoroughly next time!
Sorry all. Anyway, in case it may help another newby:

1. As SolarFlux stated you don't need to worry about all those TCP flags
as the 'scrub' option automatically removes all packets which have
invalid combinations.

2. According to the PF-FAQ, PF can only gather logs on ONE interface.

3. The odd results I was detecting when scanning my network can be
explained. Basically it is because I am scanning my hardware linksys
router rather then the OpenBSD firewall. Looks like my OpenBSD f/w
may be somewhat overkill, but what the hell it is good practice!

My previous scans were showing IDENT (port 113) as closed.
I have now stealthed this in my hardware router by forwarding all TCP
traffic arriving at port 113 to a non-existent private IP address.

I have proved that the hardware filter is doing most of the work by
running 'tcpdump -n -e -ttt -i pflog0' on my OpenBSD machine and then
from my internal machine visiting 'https://grc.com/x/ne.dll?rh1dkyd2'
which scans the first 1056 ports. tcpdump shows:

Aug 03 13:49:23.329836 rule 16/0 (match): pass in on xl0:
192.168.255.2.1127 &gt; 204.1.226.443: S 1390005174:1390005174(0)
win 16384 &lt;mss 1460,nop,nop,sackOK&gt; (DF)

Aug 03 13:49:23.329905 rule 18/0 (match): pass out on vr0:
192.168.255.2.1127 &gt; 204.1.226.443: S 538329238:538329238(0)
win 16384 &lt;mss 1460,nop,nop,sackOK&gt; (DF)

So if I am reading this correctly, it shows https session to grc.com but no
evidence of the port scans getting through to OpenBSD machine (i.e.
linksys router blocks them)

I only want http and https for my internal browsing machine. I can see
the rules working if I try to ftp://ftp.openbsd.org [port 21]:

Aug 03 14:04:28.839785 rule 1/0 (match): block out on vr0:
192.168.255.2.1140 &gt; 129.128.5.191.21 : S
319738980:3319738980(0) win 16384 &lt;mss 1460,nop,nop,sackOK&gt;
(DF)


If it helps anyone else, here is no final setup (note I slightly changed my internal subnetting):

PS Any suggestions are always welcome!

Cheers
Junky [network and system configuration files follow...]


ISP
|
|
Cable Modem
|
|
| [W]
Linksys Router [Port forwards Port 113 [IDENT] to non existent IP 192.168.1.100]
| [L]
|
|
P1----------DMZ
P2----------XBOX (yes, i know)
P3----------[vr0] OpenBSD-PF [xl0]---------------[I] Browsing Machine
P4-X
P5-X

Where:
[W] = DHCP assigned by ISP
[L] = 192.168.1.1/255.255.255.0
[vr0] = 192.168.1.4/255.255.255.0
[xl0] = 192.168.255.1/255.255.255.0
[I] = 192.168.255.2/255.255.255.0

Browsing machine uses gateway address of 192.168.255.1
OpenBSD machine uses gateway address of 192.168.1.1

The configuration files:

/etc/pf.conf

################################################## ###########

# $OpenBSD: /etc/pf.conf
# AIM: To allow filtered browsing (http and https only)
#

# MACROS
#
int_if = "xl0"
int_ip = "192.168.255.1"
ext_if = "vr0"
ext_ip = "192.168.1.4"
web_pts = "{80, 443}"

# TABLES
#
table <illegal_into_ext_if> file "/etc/pf_illegal_into_ext_if"
table <illegal_into_int_if> file "/etc/pf_illegal_into_int_if"

# OPTIONS
#
set block-policy drop # Silently drop packets
set loginterface $ext_if # PF can only gather logs on ONE interface only
set optimization normal # 1Mb/s cable link

# TRAFFIC NORMALISATION
#
scrub in all # Scrub drops TCP packets with invalid combinations
# This scrubs all incoming packets on all interfaces
# Note that fragment reassemble is default behaviour

# BANDWIDTH MANAGEMENT
# I do not need to use this currently
#

# TRANSLATION
# I have a just ONE fixed IP address on each side of firewall.
# Therefore, a 1:1 bidirectional mapping is required.
#
binat on vr0 from $int_ip to any -&gt; $ext_ip

# REDIRECTION
# I do not want any of my internal machines to be accessible
# from outside currently or allow any ftp
#

# PACKET FILTERING

# BLOCK SECTION

# Block everything to start
block drop in log all # Block and drop all in by default
block drop out log all # Block and drop all out by default

# Block all IPv6 traffic
block drop in quick inet6 all # I think previous rules probably
block drop out quick inet6 all # make these two lines redundant?

# Prevent spoofing of non-routable addresses
block drop in log quick on $ext_if from <illegal_into_ext_if> # Protect from int
block drop in quick on $int_if from <illegal_into_int_if> # Protect from me

# Antispoof all interfaces
antispoof log for vr0
antispoof log for xl0
antispoof log for lo0

# PASS SECTION

# Pass everything on loopback (lo0)
pass in quick on lo0 all
pass out quick on lo0 all

# Allow valid network tarffic in and out
pass in log on $int_if from $int_if:network to any modulate state
pass out log on $ext_if proto tcp to any port $web_pts modulate state flags S/SA
pass out log on $ext_if proto { udp, icmp } all keep state

################################################## ###########

/etc/pf_illegal_into_ext_if:

# /etc/pf_illegal_into_ext_if
#
# Allow private IP address 192.168.1.1 from the router
224.0.0.0/3
10.0.0.0/8
127.0.0.0/8
0.0.0.0/8
172.16.0.0/12
192.168.0.0/16
169.254.0.0/16
204.152.64.0/23
192.0.2.0/24
255.255.255.255/32
!192.168.1.1

################################################## ###########

/etc/pf_illegal_ip_out:

# /etc/pf_illegal_ip_out
#
# Allow traffic from internal machine 192.168.255.2
224.0.0.0/3
10.0.0.0/8
127.0.0.0/8
0.0.0.0/8
172.16.0.0/12
192.168.0.0/16
169.254.0.0/16
204.152.64.0/23
192.0.2.0/24
255.255.255.255/32
!192.168.255.2

[SolarfluX]

Nice job. Just to save some typing, you can use '-nettti' instead of '-n -e -ttt -i'... Easier to remember, too.

I was going to mention that the hardware router is getting all the scanning activity, but wanted you to figure that out for yourself.

I forgot to add the 'only one log interface at a time' to the pf-tips section, will do that shortly. Keep in mind that you could have multiple pf.conf files, each with a different logging interface, should you ever need to see stats on a different interface than the default logging if. Just enable the pf.conf relating to whichever if you want to view stats on.

Example: I use tun0 for IPv6, so if my logging if is set to my external if, I can't see any IPv6 traffic stats for my tunnel. I could create another (alternately-named) pf.conf with the logging if set to tun0 and then will be able to see stats for tunnel traffic.

The ability to log on >1 if would be a great enhancement request, if anyone wants to submit that to the OpenBSD PF crew. Something along the lines of:

The first logging if should be pflog0 (which it already is)
Second logging if should be pflog1
Etc.

[Junky]

Thanks SolarfluX.

I like the idea of having a few different pf.conf files setup to allow different network traffic through the firewall. I will definitely give that a try.

At least now I can start to experiment and continue working through my OpenBSD book to get more familiar with it!

I may even open a few holes in my hardware firewall so I can let OpenBSD take some of the strain ;-).

Cheers again and great forum - looks like I will be a regular visitor!

Cheers
Junky