7 ms·
A Beginner's Guide to Firewalling with pf
- fake-name 8y agoStep 1: Install OPNSense/PFSense?
- aphextron 8y agoPf always seemed so insanely over complicated for simple usage. It's been my one single annoyance with BSD. Are there not any good alternatives with a UFW-esque interface?
- antod 8y agoComparing UFW to pf is apples and oranges. Using a more apples to apples comparison, pf is way simpler than iptables. By bringing up UFW which is an iptables wrapper, you're not looking for a pf alternative so much as a pf wrapper. But it was the complexity of iptables that drove development of wrappers like UFW in the first place - pf doesn't really have the same level of need that iptables did. Personally having used iptables and ipfilter I always thought pf was pretty simple.
- aphextron 8y ago> By bringing up UFW which is an iptables wrapper, you're not looking for a pf alternative so much as a pf wrapper. But it was the complexity of iptables that drove development of wrappers like UFW in the first place - pf doesn't really have the same level of need that iptables did. I fully understand that Pf is equivalent to iptables, and is a lower level abstraction than UFW. But the question stands; Is there a simple foolproof utility for blocking ports on BSD with a single command? I just don't feel like whitelisting port 80 should require authoring a config file.
- upofadown 8y ago>Is there a simple foolproof utility for blocking ports on BSD with a single command? Yes. It is called pf. block in on fxp0 proto tcp to any port { 25 80 } ... blocks incoming email and http connections on the fxp0 interface. That is all you need to put in pf.conf to do that.
- bleu-ble-bleu 8y agoI agree. The syntax is very readable and easy to understand. With consumer firewalls being pwned all the time, OpenBSD with PF could be a good option for some people.
- ttul 8y agoI’m going to have to get it set up again... ahh the simplicity and robustness of OpenBSD...
- foodstances 8y agoI recommend using `egress` in a simple setup like that, it'll still work if you ever change your network device. block in on egress proto tcp to port { 25, 80 }
- petee 8y agoyes, you can, the command is called 'vi' :) block all pass proto tcp to port www
- deleted 8y ago[deleted]
- ttul 8y agoI always loved pf’s declarative syntax.
- deleted 8y ago[deleted]
- brian_cunnie 8y agoI have always found Linux's iptables particularly baroque when compared with OpenBSD's pf -- the different chains (INPUT, FORWARD, OUTPUT), the different tables ("Oh, it's the _NAT_ table you're looking for"), they seemed unnecessary complexities. My current firewall [0] has two physical interfaces, 3 additional "virtual" (VLAN-tagged) interfaces, three RFC-1918 subnets, four IPv6 subnets (dual-stack of course, except for an IPv6-only subnet) with varying degrees of security between the subnets -- and I could not imagine maintaining it with anything but pf. [0] https://github.com/cunnie/vain.nono.io-etc/blob/master/pf.conf https://github.com/cunnie/vain.nono.io-etc/blob/master/pf.co...
- dijit 8y agoI am incredulous on reading this..... Are you really saying this[0] is more complex than this?[1][2] If _anything_ I'm annoyed that linux doesn't have this. [0]: https://git.drk.sc/darkscience/ds-salt/blob/master/security/freebsd/firewall https://git.drk.sc/darkscience/ds-salt/blob/master/security/... [1]: https://git.drk.sc/darkscience/ds-salt/blob/master/security/debian/ipv4-iptables https://git.drk.sc/darkscience/ds-salt/blob/master/security/... [2]: https://git.drk.sc/darkscience/ds-salt/blob/master/security/debian/ipv6-iptables https://git.drk.sc/darkscience/ds-salt/blob/master/security/...
- hrbf 8y agoWell, try to use iptables by hand and not via wrappers like ufw and you will quickly realize that it's the other way around. pf's syntax is already very much like ufw's command line arguments. I guess what arguably may be missing if anything is a good, simple, thoroughly commented template to work from when first starting off.
- krylon 8y agoI do not remember the name[0], unfortunately, but I vaguely recall reading about a tool that gives you a high-level interface to define firewall rules and than emits a script/config file for various packet filters. It was a long time ago, though, and my memory may trick me. And if that tool really did exist, it might be unmaintained and outdated. [0] I though it was called Firestarter, but that tool appears to be Linux/iptables-specific.
- ericnyamuZZZZ 8y agowow.check out this cool forum http://mawazo.tk http://mawazo.tk
- jlgaddis 8y agoThe PF User's Guide [0] covers most of what one needs to know for basic firewalling and includes full examples of rulesets. [0]: https://www.openbsd.org/faq/pf/ https://www.openbsd.org/faq/pf/
- petee 8y agoAnd Peter Hansteen's PF tutorial is top notch too: https://home.nuug.no/~peter/pf/en/ https://home.nuug.no/~peter/pf/en/ he also has a book that I've heard is great, but don't own (yet)
- bleu-ble-bleu 8y agoThe book is amazing, and mostly a reprint of the site.
- pasbesoin 8y agoThanks for mentioning it. If this is it, it's in O'Reilly's Safari catalog (I've no association, just a Safari account): The Book of PF, 3rd Edition By: Peter N.M. Hansteen Publisher: No Starch Press Pub. Date: October 8, 2014 Print ISBN-13: 978-1-59327-589-1 Pages in Print Edition: 248 http://my.safaribooksonline.com/book/operating-systems-and-server-administration/openbsd/9781457185410 http://my.safaribooksonline.com/book/operating-systems-and-s...
- Carpetsmoker 8y ago"man pf.conf" is also very useful.
- yjftsjthsd-h 8y agoWell, it's BSD:) Good manpages are one of the things they seem to really win at.
- chris_wot 8y agoAre there any differences when dealing with MacOS?
- PhantomGremlin 8y agoThis is for a very old version of pf. The "scrub in all" construct hasn't worked since OpenBSD 4.6, which was about 8 years ago. The guide touches on how "quick" can speed up rule evaluation. But I think this misses the big picture. I write all the rules I can using "quick", and only omit it when the language constructs provided force me to. E.g. sometimes you need to "match" and so "quick" doesn't apply. I'd sure like someone to explain to me why "quick" isn't the preferred way or even the only way to do things. As best as I can figure, this awkwardness was inherited from the rules for ipf. But ipf was thrown out of OpenBSD about 15 years ago. I guess it made it easier to convert ipf rules to pf rules if "non-quick" remained the default behavior?
- ram_rar 8y agoHow does pf compare to bpf /ipsets in terms of throughput ?
- moviuro 8y agoFirst "tip" is to regularly disable the firewall. This is stupid and dangerous. I do the following on my machines: # cp /etc/pf.conf /etc/pf.conf.good # crontab -e */5 * * * * /sbin/pfctl -f /etc/pf.conf.good :x # #now vi /etc/pf.conf; pfctl -f /etc/pf.conf; and if OK: cp /etc/pf.conf /etc/pf.conf.good
- JdeBP 8y ago... especially since the tip is immediately followed by an explanation of how the author backs up a known good configuration file. The recovery mechanism should surely be to restore that known good version, as you say. It also seems overcomplex to use sudo from an unprivileged user's crontab rather than just straight execution of the target command from the superuser's crontab. I infer that your # prompt is implying this, too. (-:
- lightbyte 8y agoThat tip is supposed to apply just while you are learning how to use pf so you don't block yourself from your machine.
- moviuro 8y agoJust like suggesting `chmod 777` to have your php app work once. Just don't recommend stupid things: make them right once and the stupid thing won't ever have to go through your mind.
- ajross 8y agoSeems like a better tip would have been "Don't muck with global network settings over a ssh pipe. Use a local console, dummy". All physical hardware has them. All hosting companies offer them via various tricks. This is why.
- geff82 8y agoThe configuration syntax of pf reads like a poem, pure, clean, perfect. I really prefer PF. It is just mind-compatible. OpenBSD did a really good job here (albeit I use PF with FreeBSD only).
- yellowapple 8y agoA lot of OpenBSD's other subprojects (like OpenSMTPd and relayd/httpd) use a similar syntax. Really makes OpenBSD configuration a breeze.
- minhoryang 8y agoIt's dead link.
- blorgle 8y agoWhen I had to do some pf work, googling around rendered this project which uses pf to provide network segmentation for jails and edge firewalling. Was quite useful learning reference: https://github.com/sinner-/ansible-freebsdvps/blob/master/roles/pf/templates/pf.conf.j2 https://github.com/sinner-/ansible-freebsdvps/blob/master/ro...
- brazzledazzle 8y agoI wonder if macOS is still using an older version of pf. Last time I looked it was old enough that a lot of the examples and discussions about pf were of limited value or required translation to the older version.
- mbrumlow 8y agoI am just going to point out how much slack I got 20 years ago -- oh god it was 20 years ago -- from all my friends for running OpenBSD because I thought PF was amazing, also their release art is bad ass too. I think it is odd that of lately, that it seems to becoming popular -- as if it is something new. Either way I m happy, something old that is new again and I can spend my time learning something else, maybe k8s? nah, I will pass, some things are just fads.
- brunoqc 8y agoDo I need queuing on my OpenBSD home router or should I just use "prio" if I want my downloads to stop making my internet barely usable?
- kqr 8y agoAn important tip for people migrating from iptables: rules are not applied on a first match basis, but rather last match! I've made several mistakes due to that before..