OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: write pf rules for acces concentrator server (pppoe)

From: Stuart Henderson (stuspacehopper.org)
Date: Sun Mar 02 2008 - 12:29:27 CST


On 2008-03-02, Fratiman Vladut <vladonespaingsm.com> wrote:
> Ng interface is an netgraph node (virtual interface), like tun or tap,
> that is use by mpd4 daemon.
> Mpd4 act as acces concentrator, in order to give access to internet
> based on pppoe method.
> I use freebsd as SO, with pf firewall. This is why i post on OpenBSD
> mailing list, because is father of pf :).

that's quite an important thing to forgot to mention... especially when
you post to a list which is specifically about OpenBSD (there is a non-OS-
specific PF list, btw).

here's a description from our ifconfig(8) manual page:

     group group-name
                     Assign the interface to a ``group''. Any interface can
                     be in multiple groups.

                     For instance, such a group could be used to create a
                     hardware independent pf(4) ruleset (i.e. not one based on
                     the names of NICs) using existing (egress, carp, etc.) or
                     user-defined groups.

                     Some interfaces belong to specific groups by default:

                     - All interfaces are members of the all interface
                             group.
                     - Cloned interfaces are members of their interface
                             family group. For example, a PPP interface such
                             as ppp0 is a member of the ppp interface family
                             group.
                     - The interface(s) the default route(s) point to
                             are members of the egress interface group.
                     - IEEE 802.11 wireless interfaces are members of
                             the wlan interface group.

if you don't see something in your ifconfig manual, your OS probably
doesn't support this feature.