# replace iptables/u32 with pf



## schmurfy (May 3, 2010)

Hello,
I have a crazy question about pf: with iptables on linux you have a module called u32 which let you inspect a specific part in the packet at the packet level and act on that, I am searching for an alternative with freebsd/pf for some time now but did not found anything yet.

I read more than one time around that pf can rely on external application to identify packets but did not found anything more than the mention of it about that, maybe i just misunderstood what i read but if not it may be a solution.

The reason I need this is to identify dhcp requests from specific equipments and redirect them elsewhere while all the other requests will just pass and be handled by the dhcp daemon running on the box.


----------



## SirDice (May 3, 2010)

schmurfy said:
			
		

> The reason I need this is to identify dhcp requests from specific equipments and redirect them elsewhere while all the other requests will just pass and be handled by the dhcp daemon running on the box.


You cannot bounce traffic out the same interface as it came in with PF.


----------



## schmurfy (May 3, 2010)

In fact what i really want is to drop some packets (not redirect them) and let the others reach the dhcp server.
To be more specific I was thinking about something like (it should not be too far from that):

block in on $int_if proto udp port $dhcp_ports

The condition is missing and that is what this thread is all about :e


----------



## SirDice (May 3, 2010)

What are the conditions?


----------



## schmurfy (May 3, 2010)

the condition I want to match is (if packet contains the raw data of the packet):


```
if packet[4] == 0x3f && packet[4] == 0x02
```
(u32 is far more complex to use than the line i wrote but the idea is here)

that is how iptables and u32 works, for my current need matching against the content may be enough but u32 only allow you to match against the whole packet data.

I hope it clarify a little what i am looking for, I did not found even a clue on where to look at (I may just be looking in the wrong direction).

Thanks for taking the time to understand my need :e


----------



## SirDice (May 3, 2010)

schmurfy said:
			
		

> if packet[4] == 0x3f && packet[4] == 0x02


I may be misreading it but this never matches :e

I understand what you're trying to do, I'm just not sure on what exactly you are differentiating on. How do you test if a request comes from a specific device?

There may be other (better?) solutions for what you are trying to archive.


----------



## schmurfy (May 3, 2010)

SirDice said:
			
		

> I may be misreading it but this never matches :e


yeah written like that it will never match, I was too quick on writing it :\

The complete problem is to recognize a phone from any other devices for provisioning on a newly installed company, the phones we use (an ip phone) send some sort of signature in the dhcp request allowing us to know it came from a phone, we already have a working iptables version but for many reasons we are switching to freebsd and this is one thing i could not replace until now.

The goal of this is to put phones on a separate network than any other devices which will end up in the "data" network.

The phones do not have to be configured by us and are just sent on site in the original box, this way the client just has to open the box and plug the phone and it works !


----------



## schmurfy (May 7, 2010)

nobody has ever tried something similar here, really ?


----------



## graudeejs (May 7, 2010)

Go to linux forum


----------



## schmurfy (May 7, 2010)

If you think you answered my post killasmurf86 you should read it again :\
I do not want to use linux but replace it on this box.


----------



## blackjack (May 14, 2010)

try ng_bpf
http://www.opennet.ru/base/net/ng_bpf_build.txt.html


----------



## schmurfy (May 16, 2010)

Thanks, I already knew about bpf but not netgraph, it really looks like it could do what I want.
Now I only need to figure how it works xD


----------



## schmurfy (May 20, 2010)

I created another thread for netgraph question following this thread: http://forums.freebsd.org/showthread.php?t=14289


----------

