TL;DR - I'd like to set up a FreeBSD vm with one network card on my home LAN (192.168.1.0/24) and one on a private-internal-to-virtualbox network (10.9.9.0/24) and pass any and all traffic back and forth between the two.
Long time Linux user (Debian on servers) but only been using FreeBSD for about a day :)
Anyway, for my experimental stuff I have a virtualbox machine with 2 network interfaces - one bridged to my home LAN, one on an internal-only network. This machine is set up to be a block-nothing router, simply passing packets between eth0 and eth1 no matter source or destination. Easy enough to do with iptables -
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
But I've been trying to get this to work with pf and I'm only having partial success.
With
gateway_enable="YES"
pf_enable="YES"
pf_rules="/etc/pf.conf"
in my /etc/rc.conf and /etc/pf.conf containing
pass from em1:network to any keep state
pass from em0:network to any keep state
pass in inet proto tcp to any keep state
pass in inet proto udp to any keep state
pass out inet proto tcp to any keep state
pass out inet proto udp to any keep state
I can start a live disc vm attached only to internal and set the em1's IP as the default gateway, and be able to ping em1, ping em0, but I can't ping the host machine vbox is running on or any other machine on my LAN or connect via http, ssh, etc.
[root@bsdtest ~]# pfctl -sa
FILTER RULES:
pass in inet proto tcp all flags S/SA keep state
pass in inet proto udp all keep state
pass out inet proto tcp all flags S/SA keep state
pass out inet proto udp all keep state
pass inet from 10.9.9.0/24 to any flags S/SA keep state
pass inet from 192.168.1.0/24 to any flags S/SA keep state
STATES:
all tcp 192.168.1.90:22 <- 192.168.1.10:48102 ESTABLISHED:ESTABLISHED
all udp 192.168.1.2:53 <- 10.9.9.5:59075 NO_TRAFFIC:SINGLE
all udp 10.9.9.5:59075 -> 192.168.1.2:53 SINGLE:NO_TRAFFIC
all udp 192.168.1.2:53 <- 10.9.9.5:34207 NO_TRAFFIC:SINGLE
all udp 10.9.9.5:34207 -> 192.168.1.2:53 SINGLE:NO_TRAFFIC
all udp 192.168.1.2:53 <- 10.9.9.5:43515 NO_TRAFFIC:SINGLE
all udp 10.9.9.5:43515 -> 192.168.1.2:53 SINGLE:NO_TRAFFIC
all udp 192.168.1.2:53 <- 10.9.9.5:1636 NO_TRAFFIC:SINGLE
all udp 10.9.9.5:1636 -> 192.168.1.2:53 SINGLE:NO_TRAFFIC
all udp 192.168.1.2:53 <- 10.9.9.5:60124 NO_TRAFFIC:SINGLE
all udp 10.9.9.5:60124 -> 192.168.1.2:53 SINGLE:NO_TRAFFIC
all udp 192.168.1.2:53 <- 10.9.9.5:8866 NO_TRAFFIC:SINGLE
all udp 10.9.9.5:8866 -> 192.168.1.2:53 SINGLE:NO_TRAFFIC
all udp 192.168.1.2:53 <- 10.9.9.5:25534 NO_TRAFFIC:SINGLE
all udp 10.9.9.5:25534 -> 192.168.1.2:53 SINGLE:NO_TRAFFIC
all udp 192.168.1.2:53 <- 10.9.9.5:30141 NO_TRAFFIC:SINGLE
all udp 10.9.9.5:30141 -> 192.168.1.2:53 SINGLE:NO_TRAFFIC
INFO:
Status: Enabled for 0 days 00:08:28 Debug: Urgent
State Table Total Rate
current entries 17
searches 1990 3.9/s
inserts 253 0.5/s
removals 236 0.5/s
Counters
match 253 0.5/s
bad-offset 0 0.0/s
fragment 0 0.0/s
short 0 0.0/s
normalize 0 0.0/s
memory 0 0.0/s
bad-timestamp 0 0.0/s
congestion 0 0.0/s
ip-option 0 0.0/s
proto-cksum 0 0.0/s
state-mismatch 0 0.0/s
state-insert 0 0.0/s
state-limit 0 0.0/s
src-limit 0 0.0/s
synproxy 0 0.0/s
map-failed 0 0.0/s
TIMEOUTS:
tcp.first 120s
tcp.opening 30s
tcp.established 86400s
tcp.closing 900s
tcp.finwait 45s
tcp.closed 90s
tcp.tsdiff 30s
udp.first 60s
udp.single 30s
udp.multiple 60s
icmp.first 20s
icmp.error 10s
other.first 60s
other.single 30s
other.multiple 60s
frag 30s
interval 10s
adaptive.start 6000 states
adaptive.end 12000 states
src.track 0s
LIMITS:
states hard limit 10000
src-nodes hard limit 10000
frags hard limit 5000
table-entries hard limit 200000
OS FINGERPRINTS:
758 fingerprints loaded
[root@bsdtest ~]#
Any ideas? The lines regarding udp traffic to 192.168.1.2 from 10.9.9.5 (my live disc) would be for DNS to my home LAN name server, but no responses ever arrive... Here's what a http request shows -
[root@bsdtest ~]# pfctl -sa | grep 80
all tcp 192.168.1.10:80 <- 10.9.9.5:59436 CLOSED:SYN_SENT
all tcp 10.9.9.5:59436 -> 192.168.1.10:80 SYN_SENT:CLOSED
all tcp 192.168.1.10:80 <- 10.9.9.5:59438 CLOSED:SYN_SENT
all tcp 10.9.9.5:59438 -> 192.168.1.10:80 SYN_SENT:CLOSED
Ideas?