#### HOST #### puffy$ ifconfig lo0: flags=8049 mtu 32768 index 3 priority 0 llprio 3 groups: lo inet6 ::1 prefixlen 128 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 inet 127.0.0.1 netmask 0xff000000 em0: flags=8843 mtu 1500 lladdr 00:1e:67:99:5a:9c index 1 priority 0 llprio 3 groups: egress media: Ethernet autoselect (1000baseT full-duplex,master,rxpause,txpause) status: active inet 94.130.23.23 netmask 0xffffffc0 broadcast 94.130.23.63 inet6 fe80::fb47:ba3b:a104:e844%em0 prefixlen 64 scopeid 0x1 inet6 2a01:4f8:10b:1c4c::1 prefixlen 64 enc0: flags=0<> index 2 priority 0 llprio 3 groups: enc status: active vether0: flags=8943 mtu 1500 lladdr fe:e1:ba:d0:1d:d0 index 5 priority 0 llprio 3 groups: vether media: Ethernet autoselect status: active inet 10.0.0.1 netmask 0xffff0000 broadcast 10.0.255.255 pflog0: flags=141 mtu 33136 index 6 priority 0 llprio 3 groups: pflog bridge0: flags=41 description: switch1-uplink index 41 llprio 3 groups: bridge priority 32768 hellotime 2 fwddelay 15 maxage 20 holdcnt 6 proto rstp tap0 flags=3 port 42 ifpriority 0 ifcost 0 vether0 flags=3 port 5 ifpriority 0 ifcost 0 tap0: flags=8943 mtu 1500 lladdr fe:e1:ba:d3:a5:a3 description: vm1-if0-shell.codevoid.de index 42 priority 0 llprio 3 groups: tap status: active puffy$ cat /etc/mygate 94.130.23.1 fe80::1%em0 puffy$ cat /etc/hostname.em0 inet 94.130.23.23 255.255.255.192 inet alias 46.4.155.120 255.255.255.248 inet alias 46.4.155.121 255.255.255.248 inet alias 46.4.155.122 255.255.255.248 inet alias 46.4.155.123 255.255.255.248 inet alias 46.4.155.124 255.255.255.248 inet alias 46.4.155.125 255.255.255.248 inet alias 46.4.155.126 255.255.255.248 inet alias 46.4.155.127 255.255.255.248 inet6 2a01:4f8:10b:1c4c::1 64 up puffy$ cat /etc/hostname.vether0 inet 10.0.0.1 255.255.0.0 up puffy$ cat /etc/hostname.bridge0 add vether0 !route add 46.4.155.120 10.0.1.0 !route add 46.4.155.121 10.0.1.1 !route add 46.4.155.122 10.0.1.2 !route add 46.4.155.123 10.0.1.3 !route add 46.4.155.124 10.0.1.4 !route add 46.4.155.125 10.0.1.5 !route add 46.4.155.126 10.0.1.6 !route add 46.4.155.127 10.0.1.7 !route add 2a01:4f8:10b:1c4c::120 10.0.1.0 !route add 2a01:4f8:10b:1c4c::121 10.0.1.1 !route add 2a01:4f8:10b:1c4c::122 10.0.1.2 !route add 2a01:4f8:10b:1c4c::123 10.0.1.3 !route add 2a01:4f8:10b:1c4c::124 10.0.1.4 !route add 2a01:4f8:10b:1c4c::125 10.0.1.5 !route add 2a01:4f8:10b:1c4c::126 10.0.1.6 !route add 2a01:4f8:10b:1c4c::127 10.0.1.7 puffy# cat /etc/pf.conf # MACRO SECTION host = "94.130.23.23" # on em0 shell_ext = "46.4.155.121" # on em0 shell_int = "10.0.1.1" # on vether0 shell_ports = "{ 22, 80, 443, 58273 }" # SKIP set skip on lo set skip on vether0 # POLICY block all # EXPLICIT ALLOW # (so no rule below can block it) pass in quick on em0 proto tcp to $host port 22 # EXPLICIT BLOCKING # (so no rule below can free it again) block in quick on em0 proto {udp,tcp} to port 111 block out quick on em0 proto {udp,tcp} to port 111 # RULES (puffy) pass in on em0 proto tcp from any to $host port 22 pass out on em0 from $host to any nat-to $host # RULES (shell) pass in on em0 proto icmp to $shell_ext rdr-to $shell_int pass in on em0 proto tcp to $shell_ext port 22 rdr-to $shell_int pass out on em0 from $shell_int nat-to $shell_ext #### VM ### ~$ ifconfig lo0: flags=8049 mtu 32768 index 3 priority 0 llprio 3 groups: lo inet6 ::1 prefixlen 128 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 inet 127.0.0.1 netmask 0xff000000 vio0: flags=8b43 mtu 1500 lladdr fe:e1:bb:d1:9c:54 index 1 priority 0 llprio 3 groups: egress media: Ethernet autoselect status: active inet 10.0.1.1 netmask 0xffff0000 broadcast 10.0.255.255 enc0: flags=0<> index 2 priority 0 llprio 3 groups: enc status: active pflog0: flags=141 mtu 33136 index 4 priority 0 llprio 3 groups: pflog ~$ cat /etc/hostname.vio0 inet 10.0.1.1 255.255.0.0 up ~$ cat /etc/mygate 10.0.0.1 ~$ ping 10.0.0.1 PING 10.0.0.1 (10.0.0.1): 56 data bytes 64 bytes from 10.0.0.1: icmp_seq=0 ttl=255 time=7.547 ms 64 bytes from 10.0.0.1: icmp_seq=1 ttl=255 time=20.056 ms 64 bytes from 10.0.0.1: icmp_seq=2 ttl=255 time=20.171 ms 64 bytes from 10.0.0.1: icmp_seq=3 ttl=255 time=0.202 ms 64 bytes from 10.0.0.1: icmp_seq=4 ttl=255 time=20.172 ms 64 bytes from 10.0.0.1: icmp_seq=5 ttl=255 time=0.196 ms 64 bytes from 10.0.0.1: icmp_seq=6 ttl=255 time=20.169 ms 64 bytes from 10.0.0.1: icmp_seq=7 ttl=255 time=0.195 ms