comp.unix.bsd.openbsd.misc Google Group

Re: IP Filter Documentation.

k...@have.it (Sioux C. Queue) — Mon, 13 May 2013 21:55:53 UT

Thank you. I think I finally figured it out, thanks to several people pointing
a different, related, things. I put my pf.conf out hoping someone would say it
was "good" or "no good", but nobody has said a word. In any event I've stopped
looking at it and have moved on to configuring snort.

Re: IP Filter Documentation.

sp4mtr4p.boudew...@indes.com (Boudewijn Dijkstra) — Mon, 13 May 2013 08:19:35 UT

Op Sat, 04 May 2013 23:07:25 +0200 schreef Sioux C. Queue <k...@have.it>:

From the pf.conf(5) manual page:
self Expands to all addresses assigned to all interfaces.

pf.conf

k...@have.it (Sioux C. Queue) — Thu, 09 May 2013 20:25:41 UT

After going through the FAQ here's what I came up with, which is almost exactly
word for word of what's in the FAQ. It works, but if anybody spots something
wrong please let me know.

Angels = "rl0"
Demons = "ne1"
Saints = "192.168.1.0/27"

table <firewall> const { self }

set skip on lo0

Re: Option to grep.

bpdnichol...@d-and-d.com (DoN. Nichols) — Thu, 09 May 2013 02:48:58 UT

[ ... ]

I can understand the motivation to go there for winter. New
Hampshire was cold enough for me back in the early 1960s. :-)

For that matter, I still use a checking program which came from
the OS-9 users group (Micrware's multi-user multi-tasking OS-9 -- not
the later Apple Mac one), which I ported to unix decades ago, and keep

Re: Option to grep.

k...@have.it (Sioux C. Queue) — Wed, 08 May 2013 19:06:32 UT

The machine that has OpenSUSE here at home is an old

ARGGGGHHHHH!!!! I did it again. OpenBSD! Muscle memory has me typing OpenSUSE
automagically. Actually it did have OpenSUSE on it up to when we had a power
hit late last month and the drive went TU.

Re: Option to grep.

k...@have.it (Sioux C. Queue) — Wed, 08 May 2013 16:53:17 UT

Several years ago I did some looking at the various OS's available. OpenBSD was
rated right up at the top for security. Which is why I chose it for that
particular machine. Right now I'm reading up on pf, and after that I'll start
working on snort. I remember using ipchains, then iptables, long ago. I'm not

Re: Option to grep.

k...@have.it (Sioux C. Queue) — Wed, 08 May 2013 16:24:51 UT

Thanks, I have that bookmarked now.

Re: Option to grep.

ratf...@food.skaterat.net (John McGrail) — Wed, 08 May 2013 11:13:55 UT

Coreutils is available in package form as well, so you don't have to compile
it if you don't want to.

--
ratf...@food.skaterat.net
All foods should be removed to reply

Re: Option to grep.

ratf...@food.skaterat.net (John McGrail) — Wed, 08 May 2013 11:10:46 UT

I use [link]

--
ratf...@food.skaterat.net
All foods should be removed to reply

Re: Option to grep.

bpdnichol...@d-and-d.com (DoN. Nichols) — Wed, 08 May 2013 04:23:42 UT

ggrep is what you get when you run the configure script with
"--prefix=g" (so all the common commands created have an extra 'g' at
the start of the name, so they don't cause problems with slightly
different behavior from the standard commands installed with the OS.)

Just for the fun of it, try invoking your copy with the "--help"

Re: Option to grep.

k...@have.it (Sioux C. Queue) — Tue, 07 May 2013 04:56:38 UT

Well, someone pointed me at ggrep which works fine. As to compilers, since the
machine sits between my other computers and the evil Internet, I intend to pull
all the compilers off of it. One of those things I'm going to do RSN. Right
now there's no X or games, not needed. It has two jobs, get in the middle and

Re: Option to grep.

bpdnichol...@d-and-d.com (DoN. Nichols) — Tue, 07 May 2013 03:12:52 UT

So -- why not download the source and compile it? It is
packaged with coreutils-8.9, FWIW.

Just compile the coreutils-8.9 or later, using the option to put
a prefix in front of the commands (so you can invoke them differently
from the ones which come with OpenBSD), and edit your script to call the

IP Filter Documentation.

k...@have.it (Sioux C. Queue) — Sat, 04 May 2013 21:07:25 UT

The FAQ at OpenSUSE is a fine document. On the page
[link] I found this "or the self keyword". On the
page [link] I found this "table <firewall> const {
self }". And finally, I think, at [link] there's this
"The word self will appear if the state is floating". All of which are nice.

Re: Option to grep.

k...@have.it (Sioux C. Queue) — Fri, 03 May 2013 15:34:06 UT

I think my previous reply went into the ether.

Thanks for teh ggrep pointer, I have it installed and will be checking out the
script today.

Do you know of a place where I can get a brief description of the packages in
places like that? It's been over 15 years since the last time I diddled with a

Re: Option to grep.

ratf...@food.skaterat.net (John McGrail) — Fri, 03 May 2013 01:00:32 UT

The grep that comes with OpenBSD is not GNU grep. GNU grep and related utils
are available in the ggrep port. 2.13 is available for 5.2 prebuilt. 2.14
might be available via building ports yourself. If the options you are using
are not new options then 2.13 will likely work.

--
ratf...@food.skaterat.net