Freebsd
FreeBSD 13 PF 阻止越獄流量
將我的 FreeBSD 系統從 12.2 升級到 13.0-p3 後,PF 阻止了所有流向我的監獄的流量。禁用 PF 時,一切正常(除了不受保護;))
我試圖通過設置’block in log all’來弄清楚是什麼規則阻止了這個流量,但是除了一些明顯的多播內容之外,沒有任何東西可以解釋為什麼這個流量被阻止了。
同樣,在 12.2 版本下一切正常之前。我確實找到了一些關於 v13 現在過濾 VLAN 而不是 lo0 的文章,但我不使用任何 VLAN。
我應該進一步尋求什麼方向?
2021 年 7 月 15 日更新:
為清楚起見:這是我的 pf_rules 文件:
set block-policy return set optimization aggressive set skip on { lo0, lo1, lo2, lo3, lo4, lo5 } ext_if=hn0 ext_address="{ 192.x.x.x, 2001:981:x.x::x }" ext_services = "{ ssh, http, https, smtp, smtps }" tcp_services = "{ ftp, ssh, domain, ntp, www, smtp, smtps, submission, http, https,nfs}" udp_services = "{ domain, ntp, nfs }" icmp6_types="{ 2, 128 }" # packet too big, echo request (ping6) icmp6_types_ext_if="{ 128, 133, 134, 135, 136, 137 }" jail_net = "192.168.1.0/24" jail_services = "{ mysql, http, smtp, 587, 3000 }" table <sshguard> persist scrub in all nat pass on $ext_if from $jail_net to any -> $ext_address block in log on $ext_if proto tcp from <sshguard> to any port ssh label "ssh bruteforce" block in log all pass in quick from <pf_whitelist> flags S/SA synproxy state pass out on $ext_if inet6 proto icmp6 all icmp6-type echoreq keep state pass out on $ext_if inet proto udp to port 33433:33626 pass out on $ext_if inet6 proto udp to port 33433:33626 pass in on $ext_if inet6 proto ipv6-icmp icmp6-type $icmp6_types keep state pass in on $ext_if inet6 proto ipv6-icmp from any to { ($ext_if ), ff02::1/16 } icmp6-type $i cmp6_types_ext_if keep state pass in on $ext_if proto tcp from any to $ext_address port $ext_services keep state pass in on $ext_if inet6 proto tcp from any to $ext_address port $ext_services keep state pass out on $ext_if inet proto tcp to any port $tcp_services keep state pass out on $ext_if inet6 proto tcp to any port $tcp_services keep state pass out on $ext_if inet6 proto udp to any port $udp_services pass proto udp to any port $udp_services keep state pass in proto tcp from any to $jail_net port $jail_services keep state pass out proto tcp from $jail_net to any port $jail_services keep state pass inet proto icmp from any to any
這已經工作了很多年,直到 FreeBSD 13
顯然,這與 PF 無關,而是與從 12.2 版升級到 13.0 版的過程有關。在物理伺服器上安裝版本 13 並使用一些服務創建監獄工作正常。所以它可能與虛擬伺服器上的升級有關,無論是 Hyper-V 還是其他東西。我仍然不知道設置和配置中的所有內容看起來都一樣(我從升級的虛擬伺服器複製了大部分內容,但它不起作用)
引用TCP SYN 代理:
| 如果 PF 在網橋(4) 上執行,SYN 代理將不起作用。
刪除標誌synproxy
pass in quick from <pf_whitelist> flags S/SA synproxy state
試試吧
pass in quick from <pf_whitelist> flags S/SA keep state
如果這可行,您可以將其僅用於監獄,並為其他人保留同步代理,例如
pass in quick from <pf_whitelist> to $jail_net flags S/SA keep state pass in quick from <pf_whitelist> flags S/SA synproxy state