☰

FreeBSD 13 PF 阻止 jail 流量

tag-icon • tag-icon freebsd pf jail
FreeBSD 13 PF 阻止 jail 流量

将我的 FreeBSD 系统从 12.2 升级到 13.0-p3 后，PF 阻止了所有到我 jail 的流量。禁用 PF 后，一切正常（除了不受保护 ;)）

我尝试通过设置“阻止所有日志”来找出阻止此流量的规则，但除了一些明显的多播内容之外，没有任何内容可以解释为什么阻止此流量。

再次强调，之前在 12.2 版本下一切都运行良好。我确实找到了一些关于 v13 现在通过 VLAN 而不是 lo0 进行过滤的文章，但我没有使用任何 VLAN。

我应该朝什么方向进一步寻求？

更新2021-07-15：

为了清楚起见：这是我的 pf_rules 文件：

set block-policy return
set optimization aggressive
set skip on { lo0, lo1, lo2, lo3, lo4, lo5 }
ext_if=hn0
ext_address="{ 192.x.x.x, 2001:981:x.x::x }"
ext_services = "{ ssh, http, https, smtp, smtps }"
tcp_services = "{ ftp, ssh, domain, ntp, www, smtp, smtps, submission, http, https,nfs}"
udp_services = "{ domain, ntp, nfs }"
icmp6_types="{ 2, 128 }" # packet too big, echo request (ping6)
icmp6_types_ext_if="{ 128, 133, 134, 135, 136, 137 }"
jail_net = "192.168.1.0/24"
jail_services = "{ mysql, http, smtp, 587, 3000 }"
table <sshguard> persist
scrub in all
nat pass on $ext_if from $jail_net to any -> $ext_address
block in log on $ext_if proto tcp from <sshguard> to any port ssh label "ssh bruteforce"
block in log all
pass in quick from <pf_whitelist> flags S/SA synproxy state
pass out on $ext_if inet6 proto icmp6 all icmp6-type echoreq keep state
pass out on $ext_if inet proto udp to port 33433:33626
pass out on $ext_if inet6 proto udp to port 33433:33626
pass in on $ext_if inet6 proto ipv6-icmp icmp6-type $icmp6_types keep state
pass in on $ext_if inet6 proto ipv6-icmp from any to { ($ext_if ), ff02::1/16 } icmp6-type $i
cmp6_types_ext_if keep state
pass in on $ext_if proto tcp from any to $ext_address port $ext_services keep state
pass in on $ext_if inet6 proto tcp from any to $ext_address port $ext_services keep state
pass out on $ext_if inet proto tcp to any port $tcp_services keep state
pass out on $ext_if inet6 proto tcp to any port $tcp_services keep state
pass out on $ext_if inet6 proto udp to any port $udp_services
pass proto udp to any port $udp_services keep state
pass in proto tcp from any to $jail_net port $jail_services keep state
pass out proto tcp from $jail_net to any port $jail_services keep state
pass inet proto icmp from any to any

这个方法已经奏效很多年了，直到 FreeBSD 13

答案1

引自TCP SYN 代理：

|如果 PF 在桥接器 (4) 上运行，则 SYN 代理将不起作用。

移除标志同步代理

pass in quick from <pf_whitelist> flags S/SA synproxy state

尝试一下

pass in quick from <pf_whitelist> flags S/SA keep state

如果这个有效，你可以只在监狱使用它，并保持同步代理对于其他人来说，例如

pass in quick from <pf_whitelist> to $jail_net flags S/SA keep state
pass in quick from <pf_whitelist> flags S/SA synproxy state

答案2

显然这与 PF 无关，而是与从版本 12.2 升级到 13.0 的过程有关。在物理服务器上安装版本 13 并创建包含某些服务的 jail 工作正常。因此，这可能与虚拟服务器（无论是 Hyper-V 还是其他）上的升级有关。我仍然不知道，因为设置和配置中的所有内容看起来都一样（大部分内容都是我从升级后的虚拟服务器中复制的，但它不起作用）

相关内容