4 ms·

Pf always seemed so insanely over complicated for simple usage. It's been my one single annoyance with BSD. Are there not any good alternatives with a UFW-esque

Pf always seemed so insanely over complicated for simple usage. It's been my one single annoyance with BSD. Are there not any good alternatives with a UFW-esque interface?

antod 8y ago
Comparing UFW to pf is apples and oranges. Using a more apples to apples comparison, pf is way simpler than iptables. By bringing up UFW which is an iptables wrapper, you're not looking for a pf alternative so much as a pf wrapper. But it was the complexity of iptables that drove development of wrappers like UFW in the first place - pf doesn't really have the same level of need that iptables did. Personally having used iptables and ipfilter I always thought pf was pretty simple.
- aphextron 8y ago
  > By bringing up UFW which is an iptables wrapper, you're not looking for a pf alternative so much as a pf wrapper. But it was the complexity of iptables that drove development of wrappers like UFW in the first place - pf doesn't really have the same level of need that iptables did. I fully understand that Pf is equivalent to iptables, and is a lower level abstraction than UFW. But the question stands; Is there a simple foolproof utility for blocking ports on BSD with a single command? I just don't feel like whitelisting port 80 should require authoring a config file.
  - upofadown 8y ago
    >Is there a simple foolproof utility for blocking ports on BSD with a single command? Yes. It is called pf. block in on fxp0 proto tcp to any port { 25 80 } ... blocks incoming email and http connections on the fxp0 interface. That is all you need to put in pf.conf to do that.
    - bleu-ble-bleu 8y ago
      I agree. The syntax is very readable and easy to understand. With consumer firewalls being pwned all the time, OpenBSD with PF could be a good option for some people.
      - ttul 8y ago
        I’m going to have to get it set up again... ahh the simplicity and robustness of OpenBSD...
    - foodstances 8y ago
      I recommend using `egress` in a simple setup like that, it'll still work if you ever change your network device. block in on egress proto tcp to port { 25, 80 }
  - petee 8y ago
    yes, you can, the command is called 'vi' :) block all pass proto tcp to port www
deleted 8y ago
[deleted]
ttul 8y ago
I always loved pf’s declarative syntax.
deleted 8y ago
[deleted]
brian_cunnie 8y ago
I have always found Linux's iptables particularly baroque when compared with OpenBSD's pf -- the different chains (INPUT, FORWARD, OUTPUT), the different tables ("Oh, it's the _NAT_ table you're looking for"), they seemed unnecessary complexities. My current firewall [0] has two physical interfaces, 3 additional "virtual" (VLAN-tagged) interfaces, three RFC-1918 subnets, four IPv6 subnets (dual-stack of course, except for an IPv6-only subnet) with varying degrees of security between the subnets -- and I could not imagine maintaining it with anything but pf. [0] https://github.com/cunnie/vain.nono.io-etc/blob/master/pf.conf https://github.com/cunnie/vain.nono.io-etc/blob/master/pf.co...
dijit 8y ago
I am incredulous on reading this..... Are you really saying this[0] is more complex than this?[1][2] If _anything_ I'm annoyed that linux doesn't have this. [0]: https://git.drk.sc/darkscience/ds-salt/blob/master/security/freebsd/firewall https://git.drk.sc/darkscience/ds-salt/blob/master/security/... [1]: https://git.drk.sc/darkscience/ds-salt/blob/master/security/debian/ipv4-iptables https://git.drk.sc/darkscience/ds-salt/blob/master/security/... [2]: https://git.drk.sc/darkscience/ds-salt/blob/master/security/debian/ipv6-iptables https://git.drk.sc/darkscience/ds-salt/blob/master/security/...
hrbf 8y ago
Well, try to use iptables by hand and not via wrappers like ufw and you will quickly realize that it's the other way around. pf's syntax is already very much like ufw's command line arguments. I guess what arguably may be missing if anything is a good, simple, thoroughly commented template to work from when first starting off.
krylon 8y ago
I do not remember the name[0], unfortunately, but I vaguely recall reading about a tool that gives you a high-level interface to define firewall rules and than emits a script/config file for various packet filters. It was a long time ago, though, and my memory may trick me. And if that tool really did exist, it might be unmaintained and outdated. [0] I though it was called Firestarter, but that tool appears to be Linux/iptables-specific.

Pf always seemed so insanely over complicated for simple usage. It's been my one single annoyance with BSD. Are there not any good alternatives with a UFW-esque interface?

antod 8y ago

Comparing UFW to pf is apples and oranges. Using a more apples to apples comparison, pf is way simpler than iptables. By bringing up UFW which is an iptables wrapper, you're not looking for a pf alternative so much as a pf wrapper. But it was the complexity of iptables that drove development of wrappers like UFW in the first place - pf doesn't really have the same level of need that iptables did. Personally having used iptables and ipfilter I always thought pf was pretty simple.

aphextron 8y ago
> By bringing up UFW which is an iptables wrapper, you're not looking for a pf alternative so much as a pf wrapper. But it was the complexity of iptables that drove development of wrappers like UFW in the first place - pf doesn't really have the same level of need that iptables did. I fully understand that Pf is equivalent to iptables, and is a lower level abstraction than UFW. But the question stands; Is there a simple foolproof utility for blocking ports on BSD with a single command? I just don't feel like whitelisting port 80 should require authoring a config file.
- upofadown 8y ago
  >Is there a simple foolproof utility for blocking ports on BSD with a single command? Yes. It is called pf. block in on fxp0 proto tcp to any port { 25 80 } ... blocks incoming email and http connections on the fxp0 interface. That is all you need to put in pf.conf to do that.
  - bleu-ble-bleu 8y ago
    I agree. The syntax is very readable and easy to understand. With consumer firewalls being pwned all the time, OpenBSD with PF could be a good option for some people.
    - ttul 8y ago
      I’m going to have to get it set up again... ahh the simplicity and robustness of OpenBSD...
  - foodstances 8y ago
    I recommend using `egress` in a simple setup like that, it'll still work if you ever change your network device. block in on egress proto tcp to port { 25, 80 }
- petee 8y ago
  yes, you can, the command is called 'vi' :) block all pass proto tcp to port www

deleted 8y ago

[deleted]

ttul 8y ago

I always loved pf’s declarative syntax.

deleted 8y ago

[deleted]

brian_cunnie 8y ago

I have always found Linux's iptables particularly baroque when compared with OpenBSD's pf -- the different chains (INPUT, FORWARD, OUTPUT), the different tables ("Oh, it's the _NAT_ table you're looking for"), they seemed unnecessary complexities. My current firewall [0] has two physical interfaces, 3 additional "virtual" (VLAN-tagged) interfaces, three RFC-1918 subnets, four IPv6 subnets (dual-stack of course, except for an IPv6-only subnet) with varying degrees of security between the subnets -- and I could not imagine maintaining it with anything but pf. [0] https://github.com/cunnie/vain.nono.io-etc/blob/master/pf.conf https://github.com/cunnie/vain.nono.io-etc/blob/master/pf.co...

dijit 8y ago

I am incredulous on reading this..... Are you really saying this[0] is more complex than this?[1][2] If _anything_ I'm annoyed that linux doesn't have this. [0]: https://git.drk.sc/darkscience/ds-salt/blob/master/security/freebsd/firewall https://git.drk.sc/darkscience/ds-salt/blob/master/security/... [1]: https://git.drk.sc/darkscience/ds-salt/blob/master/security/debian/ipv4-iptables https://git.drk.sc/darkscience/ds-salt/blob/master/security/... [2]: https://git.drk.sc/darkscience/ds-salt/blob/master/security/debian/ipv6-iptables https://git.drk.sc/darkscience/ds-salt/blob/master/security/...

hrbf 8y ago

Well, try to use iptables by hand and not via wrappers like ufw and you will quickly realize that it's the other way around. pf's syntax is already very much like ufw's command line arguments. I guess what arguably may be missing if anything is a good, simple, thoroughly commented template to work from when first starting off.

krylon 8y ago

I do not remember the name[0], unfortunately, but I vaguely recall reading about a tool that gives you a high-level interface to define firewall rules and than emits a script/config file for various packet filters. It was a long time ago, though, and my memory may trick me. And if that tool really did exist, it might be unmaintained and outdated. [0] I though it was called Firestarter, but that tool appears to be Linux/iptables-specific.