> Hola,
> Soy nuevo en este mundo de OpenBSD, he buscado por internet (google,
> manuales, ...) y no consigo encontrar la solución. espero que me
> puedan ayudar.

> Quiero montar un firewall transparente (bridge) con OpenBSD. El
> firewall tiene 4 interfaces de red, 2 son de cobre intel/Pro1000MT y
> las otras 2 son de Fibra Intel/Pro1000MF (una es de tipo SX y la otra
> es LX).
> La idea es utilizar las tarjetas de fibra para el bridge firewall y
> las de cobre para la administración del firewall.

> El problema es que no consigo filtrar nada en el bridge. He probado de
> poner reglas de todo tipo, sólo consigo filtrar la interface de
> administración, pero el trafico sigue atravesando el firewall. Espero
> que alguien me pueda ayudar, por internet he encontrado muchas paginas
> que explican como hacerlo y las he ido siguiendo, pero no consigo
> filtrar el trafico que pasa por el bridge. Alguna idea?

> He instalado OpenBSD4.2, detecta bien las 4 interficies (em0->Fibra SX-
> >red interna, em1->fibra LX->Internet, em2 y em3 son las interfaces de
> cobre de administracion). Las he configurado con los siguientes
> archivos de configuracion:

> # more /etc/hostname.em0
> up

> # more /etc/hostname.em1
> up

> # more /etc/hostname.em3
> inet aaa.bbb.ccc.ddd 255.255.255.128 NONE

> # more /etc/bridgename.bridge0
> add em0 add em1 up

> # more /etc/mygate

> De momento no utilizo em2. y el archivo /etc/mygate está vacio ya que
> la conexión de administración es directa.

> Aqui estan las reglas que estoy utilizando, si quito la última se me
> bloquea la interface de administración, pero el trafico sigue
> atravesando el bridge. Alguien me puede decir que estoy haciendo mal?

> # pfctl -s
> rules
> block drop in all
> block drop in quick on em0 all
> block drop in quick on em1 all
> block drop in quick on bridge0 all
> block drop out quick on em0 all
> block drop out quick on em1 all
> block drop out quick on bridge0 all
> pass in quick on em3 all flags S/SA keep state

> Resultado del dmesg:
> # dmesg
> OpenBSD 4.2 (GENERIC) #375: Tue Aug 28 10:38:44 MDT 2007
>    dera...@i386.openbsd.org:/usr/src/sys/arch/i386/compile/GENERIC
> cpu0: Intel(R) Xeon(TM) CPU 3.20GHz ("GenuineIntel" 686-class) 3.20
> GHz
> cpu0:
> FPU,V86,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFL USH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,SBF,SSE3,MWAIT,DS-
> CPL,CNXT-ID,CX16,xTPR
> real mem  = 2146795520 (2047MB)
> avail mem = 2068230144 (1972MB)
> mainbus0 at root
> bios0 at mainbus0: AT/286+ BIOS, date 09/22/05, BIOS32 rev. 0 @
> 0xffe90, SMBIOS rev. 2.3 @ 0xf9920 (87 entries)
> bios0: vendor Dell Computer Corporation version "A04" date 09/22/2005
> bios0: Dell Computer Corporation PowerEdge 1850
> pcibios0 at bios0: rev 2.1 @ 0xf0000/0x10000
> pcibios0: PCI IRQ Routing Table rev 1.0 @ 0xfb140/272 (15 entries)
> pcibios0: PCI Interrupt Router at 000:31:0 ("Intel 82801EB/ER LPC" rev
> 0x00)
> pcibios0: PCI bus #9 is the last bus
> bios0: ROM list: 0xc0000/0xb000! 0xcb000/0x1000 0xcc000/0x1000
> 0xcd000/0x2200 0xec000/0x4000!
> acpi at mainbus0 not configured
> ipmi0 at mainbus0: version 1.5 interface KCS iobase 0xca8/8 spacing 4
> cpu0 at mainbus0
> pci0 at mainbus0 bus 0: configuration mode 1 (no bios)
> pchb0 at pci0 dev 0 function 0 "Intel E7520 MCH" rev 0x09
> ppb0 at pci0 dev 2 function 0 "Intel MCH PCIE" rev 0x09
> pci1 at ppb0 bus 1
> ppb1 at pci1 dev 0 function 0 "Intel IOP332 PCIE-PCIX" rev 0x06
> pci2 at ppb1 bus 2
> em0 at pci2 dev 12 function 0 "Intel PRO/1000MF (82545GM)" rev 0x04:
> irq 10, address 00:04:23:ad:55:77
> ami0 at pci2 dev 14 function 0 "Dell PERC 4e/Di" rev 0x06: irq 7
> ami0: Dell 16c, 32b, FW 521S, BIOS vH430, 256MB RAM
> ami0: 1 channels, 0 FC loops, 1 logical drives
> scsibus0 at ami0: 40 targets
> sd0 at scsibus0 targ 0 lun 0: <AMI, Host drive #00, > SCSI2 0/direct
> fixed
> sd0: 34680MB, 4421 cyl, 255 head, 63 sec, 512 bytes/sec, 71024640 sec
> total
> scsibus1 at ami0: 16 targets
> safte0 at scsibus1 targ 6 lun 0: <PE/PV, 1x2 SCSI BP, 1.0> SCSI2 3/
> processor fixed
> ppb2 at pci1 dev 0 function 2 "Intel IOP332 PCIE-PCIX" rev 0x06
> pci3 at ppb2 bus 3
> em1 at pci3 dev 11 function 0 "Intel PRO/1000MF (82545GM)" rev 0x04:
> irq 3, address 00:04:23:c8:75:db
> ppb3 at pci0 dev 4 function 0 "Intel MCH PCIE" rev 0x09
> pci4 at ppb3 bus 4
> ppb4 at pci0 dev 5 function 0 "Intel MCH PCIE" rev 0x09
> pci5 at ppb4 bus 5
> ppb5 at pci5 dev 0 function 0 "Intel PCIE-PCIE" rev 0x09
> pci6 at ppb5 bus 6
> em2 at pci6 dev 7 function 0 "Intel PRO/1000MT (82541GI)" rev 0x05:
> irq 11, address 00:14:22:21:6a:22
> ppb6 at pci5 dev 0 function 2 "Intel PCIE-PCIE" rev 0x09
> pci7 at ppb6 bus 7
> em3 at pci7 dev 8 function 0 "Intel PRO/1000MT (82541GI)" rev 0x05:
> irq 3, address 00:14:22:21:6a:23
> ppb7 at pci0 dev 6 function 0 "Intel MCH PCIE" rev 0x09
> pci8 at ppb7 bus 8
> uhci0 at pci0 dev 29 function 0 "Intel 82801EB/ER USB" rev 0x02: irq
> 11
> uhci1 at pci0 dev 29 function 1 "Intel 82801EB/ER USB" rev 0x02: irq
> 10
> uhci2 at pci0 dev 29 function 2 "Intel 82801EB/ER USB" rev 0x02: irq 7
> ehci0 at pci0 dev 29 function 7 "Intel 82801EB/ER USB2" rev 0x02: irq
> 5
> usb0 at ehci0: USB revision 2.0
> uhub0 at usb0: Intel EHCI root hub, rev 2.00/1.00, addr 1
> ppb8 at pci0 dev 30 function 0 "Intel 82801BA AGP" rev 0xc2
> pci9 at ppb8 bus 9
> vga1 at pci9 dev 13 function 0 "ATI Radeon VE QY" rev 0x00
> wsdisplay0 at vga1 mux 1: console (80x25, vt100 emulation)
> wsdisplay0: screen 1-5 added (80x25, vt100 emulation)
> ichpcib0 at pci0 dev 31 function 0 "Intel 82801EB/ER LPC" rev 0x02: 24-
> bit timer at 3579545Hz
> pciide0 at pci0 dev 31 function 1 "Intel 82801EB/ER IDE" rev 0x02:
> DMA, channel 0 configured to compatibility, channel 1 configured to
> compatibility
> atapiscsi0 at pciide0 channel 0 drive 0
> scsibus2 at atapiscsi0: 2 targets
> cd0 at scsibus2 targ 0 lun 0: <TEAC, CD-ROM CD-224E-N, 3.AB> SCSI0 5/
> cdrom removable
> cd0(pciide0:0:0): using PIO mode 4, Ultra-DMA mode 2
> pciide0: channel 1 disabled (no drives)
> usb1 at uhci0: USB revision 1.0
> uhub1 at usb1: Intel UHCI root hub, rev 1.00/1.00, addr 1
> usb2 at uhci1: USB revision 1.0
> uhub2 at usb2: Intel UHCI root hub, rev 1.00/1.00, addr 1
> usb3 at uhci2: USB revision 1.0
> uhub3 at usb3: Intel UHCI root hub, rev 1.00/1.00, addr 1
> isa0 at ichpcib0
> isadma0 at isa0
> pckbc0 at isa0 port 0x60/5
> pckbd0 at pckbc0 (kbd slot)
> pckbc0: using irq 1 for kbd slot
> wskbd0 at pckbd0: console keyboard, using wsdisplay0
> pmsi0 at pckbc0 (aux slot)
> pckbc0: using irq 12 for aux slot
> wsmouse0 at pmsi0 mux 0
> pcppi0 at isa0 port 0x61
> midi0 at pcppi0: <PC speaker>
> spkr0 at pcppi0
> npx0 at isa0 port 0xf0/16: reported by CPUID; using exception 16
> pccom0 at isa0 port 0x3f8/8 irq 4: ns16550a, 16 byte fifo
> fdc0 at isa0 port 0x3f0/6 irq 6 drq 2
> fd0 at fdc0 drive 0: 1.44MB 80 cyl, 2 head, 18 sec
> biomask efe5 netmask efed ttymask ffef
> pctr: user-level cycle counter enabled
> mtrr: Pentium Pro MTRR support
> uhub4 at uhub0 port 3: Dell product 0xa001, rev 2.00/0.00, addr 2
> dkcsum: sd0 matches BIOS drive 0x80
> root on sd0a swap on sd0b dump on sd0b

> Gracias,

> Quimi

> Lamenteo no poder ayudarte con mas detalle pero nunca implmente un
> firewall transparente.

> Saludos,
> Hernan

> On Thu, Apr 24, 2008 at 6:05 AM, Quimi <quimi.fernan...@gmail.com> wrote:

> > Hola,
> > Soy nuevo en este mundo de OpenBSD, he buscado por internet (google,
> > manuales, ...) y no consigo encontrar la solución. espero que me
> > puedan ayudar.

> > Quiero montar un firewall transparente (bridge) con OpenBSD. El
> > firewall tiene 4 interfaces de red, 2 son de cobre intel/Pro1000MT y
> > las otras 2 son de Fibra Intel/Pro1000MF (una es de tipo SX y la otra
> > es LX).
> > La idea es utilizar las tarjetas de fibra para el bridge firewall y
> > las de cobre para la administración del firewall.

> > El problema es que no consigo filtrar nada en el bridge. He probado de
> > poner reglas de todo tipo, sólo consigo filtrar la interface de
> > administración, pero el trafico sigue atravesando el firewall. Espero
> > que alguien me pueda ayudar, por internet he encontrado muchas paginas
> > que explican como hacerlo y las he ido siguiendo, pero no consigo
> > filtrar el trafico que pasa por el bridge. Alguna idea?

> > He instalado OpenBSD4.2, detecta bien las 4 interficies (em0->Fibra SX-
> > >red interna, em1->fibra LX->Internet, em2 y em3 son las interfaces de
> > cobre de administracion). Las he configurado con los siguientes
> > archivos de configuracion:

> > # more /etc/hostname.em0
> > up

> > # more /etc/hostname.em1
> > up

> > # more /etc/hostname.em3
> > inet aaa.bbb.ccc.ddd 255.255.255.128 NONE

> > # more /etc/bridgename.bridge0
> > add em0 add em1 up

> > # more /etc/mygate

> > De momento no utilizo em2. y el archivo /etc/mygate está vacio ya que
> > la conexión de administración es directa.

> > Aqui estan las reglas que estoy utilizando, si quito la última se me
> > bloquea la interface de administración, pero el trafico sigue
> > atravesando el bridge. Alguien me puede decir que estoy haciendo mal?

> > # pfctl -s
> > rules
> > block drop in all
> > block drop in quick on em0 all
> > block drop in quick on em1 all
> > block drop in quick on bridge0 all
> > block drop out quick on em0 all
> > block drop out quick on em1 all
> > block drop out quick on bridge0 all
> > pass in quick on em3 all flags S/SA keep state

> > Resultado del dmesg:
> > # dmesg
> > OpenBSD 4.2 (GENERIC) #375: Tue Aug 28 10:38:44 MDT 2007
> >    dera...@i386.openbsd.org:/usr/src/sys/arch/i386/compile/GENERIC
> > cpu0: Intel(R) Xeon(TM) CPU 3.20GHz ("GenuineIntel" 686-class) 3.20
> > GHz
> > cpu0:
> > FPU,V86,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFL USH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,SBF,SSE3,MWAIT,DS-
> > CPL,CNXT-ID,CX16,xTPR
> > real mem  = 2146795520 (2047MB)
> > avail mem = 2068230144 (1972MB)
> > mainbus0 at root
> > bios0 at mainbus0: AT/286+ BIOS, date 09/22/05, BIOS32 rev. 0 @
> > 0xffe90, SMBIOS rev. 2.3 @ 0xf9920 (87 entries)
> > bios0: vendor Dell Computer Corporation version "A04" date 09/22/2005
> > bios0: Dell Computer Corporation PowerEdge 1850
> > pcibios0 at bios0: rev 2.1 @ 0xf0000/0x10000
> > pcibios0: PCI IRQ Routing Table rev 1.0 @ 0xfb140/272 (15 entries)
> > pcibios0: PCI Interrupt Router at 000:31:0 ("Intel 82801EB/ER LPC" rev
> > 0x00)
> > pcibios0: PCI bus #9 is the last bus
> > bios0: ROM list: 0xc0000/0xb000! 0xcb000/0x1000 0xcc000/0x1000
> > 0xcd000/0x2200 0xec000/0x4000!
> > acpi at mainbus0 not configured
> > ipmi0 at mainbus0: version 1.5 interface KCS iobase 0xca8/8 spacing 4
> > cpu0 at mainbus0
> > pci0 at mainbus0 bus 0: configuration mode 1 (no bios)
> > pchb0 at pci0 dev 0 function 0 "Intel E7520 MCH" rev 0x09
> > ppb0 at pci0 dev 2 function 0 "Intel MCH PCIE" rev 0x09
> > pci1 at ppb0 bus 1
> > ppb1 at pci1 dev 0 function 0 "Intel IOP332 PCIE-PCIX" rev 0x06
> > pci2 at ppb1 bus 2
> > em0 at pci2 dev 12 function 0 "Intel PRO/1000MF (82545GM)" rev 0x04:
> > irq 10, address 00:04:23:ad:55:77
> > ami0 at pci2 dev 14 function 0 "Dell PERC 4e/Di" rev 0x06: irq 7
> > ami0: Dell 16c, 32b, FW 521S, BIOS vH430, 256MB RAM
> > ami0: 1 channels, 0 FC loops, 1 logical drives
> > scsibus0 at ami0: 40 targets
> > sd0 at scsibus0 targ 0 lun 0: <AMI, Host drive #00, > SCSI2 0/direct
> > fixed
> > sd0: 34680MB, 4421 cyl, 255 head, 63 sec, 512 bytes/sec, 71024640 sec
> > total
> > scsibus1 at ami0: 16 targets
> > safte0 at scsibus1 targ 6 lun 0: <PE/PV, 1x2 SCSI BP, 1.0> SCSI2 3/
> > processor fixed
> > ppb2 at pci1 dev 0 function 2 "Intel IOP332 PCIE-PCIX" rev 0x06
> > pci3 at ppb2 bus 3
> > em1 at pci3 dev 11 function 0 "Intel PRO/1000MF (82545GM)" rev 0x04:
> > irq 3, address 00:04:23:c8:75:db
> > ppb3 at pci0 dev 4 function 0 "Intel MCH PCIE" rev 0x09
> > pci4 at ppb3 bus 4
> > ppb4 at pci0 dev 5 function 0 "Intel MCH PCIE" rev 0x09
> > pci5 at ppb4 bus 5
> > ppb5 at pci5 dev 0 function 0 "Intel PCIE-PCIE" rev 0x09
> > pci6 at ppb5 bus 6
> > em2 at pci6 dev 7 function 0 "Intel PRO/1000MT (82541GI)" rev 0x05:
> > irq 11, address 00:14:22:21:6a:22
> > ppb6 at pci5 dev 0 function 2 "Intel PCIE-PCIE" rev 0x09
> > pci7 at ppb6 bus 7
> > em3 at pci7 dev 8 function 0 "Intel PRO/1000MT (82541GI)" rev 0x05:
> > irq 3, address 00:14:22:21:6a:23
> > ppb7 at pci0 dev 6 function 0 "Intel MCH PCIE" rev 0x09
> > pci8 at ppb7 bus 8
> > uhci0 at pci0 dev 29 function 0 "Intel 82801EB/ER USB" rev 0x02: irq
> > 11
> > uhci1 at pci0 dev 29 function 1 "Intel 82801EB/ER USB" rev 0x02: irq
> > 10
> > uhci2 at pci0 dev 29 function 2 "Intel 82801EB/ER USB" rev 0x02: irq 7
> > ehci0 at pci0 dev 29 function 7 "Intel 82801EB/ER USB2" rev 0x02: irq
> > 5
> > usb0 at ehci0: USB revision 2.0
> > uhub0 at usb0: Intel EHCI root hub, rev 2.00/1.00, addr 1
> > ppb8 at pci0 dev 30 function 0 "Intel 82801BA AGP" rev 0xc2
> > pci9 at ppb8 bus 9
> > vga1 at pci9 dev 13 function 0 "ATI Radeon VE QY" rev 0x00
> > wsdisplay0 at vga1 mux 1: console (80x25, vt100 emulation)
> > wsdisplay0: screen 1-5 added (80x25, vt100 emulation)
> > ichpcib0 at pci0 dev 31 function 0 "Intel 82801EB/ER LPC" rev 0x02: 24-
> > bit timer at 3579545Hz
> > pciide0 at pci0 dev 31 function 1 "Intel 82801EB/ER IDE" rev 0x02:
> > DMA, channel 0 configured to compatibility, channel 1 configured to
> > compatibility
> > atapiscsi0 at pciide0 channel 0 drive 0
> > scsibus2 at atapiscsi0: 2 targets
> > cd0 at scsibus2 targ 0 lun 0: <TEAC, CD-ROM CD-224E-N, 3.AB> SCSI0 5/
> > cdrom removable
> > cd0(pciide0:0:0): using PIO mode 4, Ultra-DMA mode 2
> > pciide0: channel 1 disabled (no drives)
> > usb1 at uhci0: USB revision 1.0
> > uhub1 at usb1: Intel UHCI root hub, rev 1.00/1.00, addr 1
> > usb2 at uhci1: USB revision 1.0
> > uhub2 at usb2: Intel UHCI root hub, rev 1.00/1.00, addr 1
> > usb3 at uhci2: USB revision 1.0
> > uhub3 at usb3: Intel UHCI root hub, rev 1.00/1.00, addr 1
> > isa0 at ichpcib0
> > isadma0 at isa0
> > pckbc0 at isa0 port 0x60/5
> > pckbd0 at pckbc0 (kbd slot)
> > pckbc0: using irq 1 for kbd slot
> > wskbd0 at pckbd0: console keyboard, using wsdisplay0
> > pmsi0 at pckbc0 (aux slot)
> > pckbc0: using irq 12 for aux slot
> > wsmouse0 at pmsi0 mux 0
> > pcppi0 at isa0 port 0x61
> > midi0 at pcppi0: <PC speaker>
> > spkr0 at pcppi0
> > npx0 at isa0 port 0xf0/16: reported by CPUID; using exception 16
> > pccom0 at isa0 port 0x3f8/8 irq 4: ns16550a, 16 byte fifo
> > fdc0 at isa0 port 0x3f0/6 irq 6 drq 2
> > fd0 at fdc0 drive 0: 1.44MB 80 cyl, 2 head, 18 sec
> > biomask efe5 netmask efed ttymask ffef
> > pctr: user-level cycle counter enabled
> > mtrr: Pentium Pro MTRR support
> > uhub4 at uhub0 port 3: Dell product 0xa001, rev 2.00/0.00, addr 2
> > dkcsum: sd0 matches BIOS drive 0x80
> > root on sd0a swap on sd0b dump on sd0b

> > Gracias,

> > Quimi

> --
> # /dev/hdc
> -> OpenBSDeros.org
> hdc [at] openbsderos [dot] org