Version 1 (modified by jhickey, 10 years ago) (diff)


Gatekeeper is a bridging firewall running FreeBSD 7.3 and pf.


  • Dell PowerEdge Chassis
  • Pentium 4 2.4Ghz
  • 256Mb of RAM
  • 40GB Seagate ST340014A Hard Drive


  • Dual Port Card 1
    • em0 internet facing interface (verify)
      • ether 00:04:23:c2:8e:a8
    • em1 testbed facing interface (verify)
      • ether 00:04:23:c2:8e:a9

  • Dual Port Card 2
    • em2 is unused
      • ether 00:04:23:a5:ac:ee
    • em3 network, address
      • ether 00:04:23:a5:ac:ef

Bridging Configuration

  • bridge0 consists of em0 and em1
  • bridge0 is configured in rc.conf with the following lines:
    ifconfig_bridge0="inet netmask addm em0 addm em1 up"

PF configuration

  • Two sysctl variables need to be set in order to enable pf on a bridged interface in /etc/sysctl.conf. Rules on bridges have no direction.
  • pf is enabled in /etc/rc.conf
  • The pf.conf file is in CVS under /operations/configuration/gatekeeper
  • The kernel configuration in /operations/configuration/gatekeeper contains the pf and pflog devices:
    device          pf
    device          pflog

NAT Configuration

  • We have a NAT'ed network hanging off of gatekeeper for machines that need to access the internet, but do not need to have it.
  • The sysctl variable for ip forwarding is enabled in /etc/sysctl.conf: