olevole
commented
7 months ago Firewall management in CBSD is quite limited and creates very simple rules. This control is suitable if you do not use your own rules because, as you can see, it is quite difficult to mix/combine them together. As a rule, if you use your own rules, you should turn off the firewall in the cbsd ( cbsd natcfg + cbsd natoff ) for better control.
However, there are several ways to combine:
1) Checkout https://github.com/cbsd/cbsd/blob/develop/etc/defaults/pf.conf.tpl template. It regulates the sequence/order of includes and you can use it to include your rules. For example:
/storage/cbsd/etc/pf.conf:
## include CBSD NAT rules
include "/storage/cbsd/etc/pfnat.conf"
## include system pf RULES
include "/etc/pf.conf"
## include CBSD RDR rules
include "/storage/cbsd/etc/pfrdr.conf"
In this case, you should also change default config path for /etc/rc.d/pf service:
sysrc pf_rules="/storage/cbsd/etc/pf.conf"/storage/cbsd/etc/pf.conf is static while "/storage/cbsd/etc/{pfnat,pfrdr}.conf is dynamic and managed by CBSD.
2) Use CBSD hooks for integration with your firewall rules management. By placing your own scripts in different directories in *~cbsd/jails-system/ENV/master_.d**, you can perform the actions you need in different states of the virtual environment. In these scripts you can use internal CBSD facts (you only need $jname and $ip4_addr)
For example for jail named dnsmasq create executable file ~cbsd/jails-system/dnsmasq/master_poststart.d/0_set_rules.sh:
#!/bin/sh
cat > /tmp/0_set_rules.txt <<EOF
My jail name: ${jname}
My Full IP address list: ${ip4_addr}
Other useful facrts:
ipv4_first_public="${ipv4_first_public}"
ipv4_first_private="${ipv4_first_private}"
ipv4_first="${ipv4_first}"
ipv6_first_public="${ipv6_first_public}"
ipv6_first_private="${ipv6_first_private}"
ipv6_first="${ipv6_first}"
nic_address="${nic_address}"
nic_hwaddr0="${nic_hwaddr0}"
nic_address0="${nic_address0}"
nic_parent0="${nic_parent0}"
interface="${interface}"
EOFchmod +x ~cbsd/jails-system/dnsmasq/master_poststart.d/0_set_rules.shafter the container (or VM) starts, look at the /tmp/0_set_rules.txt. Instead of saving facts to a log file, you can create and delete ( via master_poststop.d hooks directory ) corresponding rules at runtime.
if you want hook scripts to be created by default along with the new environment, put these files in the appropriate skeleton directory ( ~cbsd/share/jail-system-default ) or create your own profile.
less /storage/cbsd/etc/pfnat.conf-> contains all the private network ranges' nat pf rules, not just those IP ranges the jails using
you can adjust this, see: https://github.com/cbsd/cbsd/blob/develop/etc/defaults/cbsd-pf.conf
For example, override this settings via ~cbsd/etc/cbsd-pf.conf:
# misc settings. Default RFC1918 network for NAT net/rules
cbsd_nat_networks="10.0.0.0/8 172.16.0.0/12"
# don't create (when '1') NAT rules for SAME network as NATIP
cbsd_nat_skip_natip_network=0^^ exclude 192.168.x.x from NAT networks.
to apply:
cbsd natoff
cbsd naton
n-connect
Mandatory info for bug reports:
FreeBSD version ( uname -a ): FreeBSD host 13.2-RELEASE-p4 FreeBSD 13.2-RELEASE-p4 GENERIC amd64
CBSD version ( cbsd version ): 14.0.6
After adding port forward rules to a cbsd jail with
cbsd expose mode=add in=111 out=1111 proto=tcp jname=jailnamecbsd expose mode=apply jname=jailname, the existing and applied rules, filtering, anchors, etc coming from the host's /etc/pf.conf get gets flushed out and only the cbsd nat/rdr rules will exist.I've checked the following files:
After checking the [expose](https://github.com/cbsd/cbsd/blob/55f486932726df331b87c26b13bc667395c69d75/tools script/expose#L9) I did not see, if CBSD wants to take care about the eixsting rules at all. Please fix me.
Temporary solution:
With these steps I can have the exsiting host's pf config and the cbsd jail's ones both. I know there is an additional possible source of problem outside of CBSD - having wrong pf rules on the hosts, but a
pfctt -nfcheck could potentially help duringcbsd apply- at least syntax level.