4 ms·
> By bringing up UFW which is an iptables wrapper, you're not looking for a pf alternative so much as a pf wrapper. But it was the complexity of iptables that d
by aphextron 8y ago
> By bringing up UFW which is an iptables wrapper, you're not looking for a pf alternative so much as a pf wrapper. But it was the complexity of iptables that drove development of wrappers like UFW in the first place - pf doesn't really have the same level of need that iptables did.
I fully understand that Pf is equivalent to iptables, and is a lower level abstraction than UFW. But the question stands; Is there a simple foolproof utility for blocking ports on BSD with a single command? I just don't feel like whitelisting port 80 should require authoring a config file.
- upofadown 8y ago>Is there a simple foolproof utility for blocking ports on BSD with a single command? Yes. It is called pf. block in on fxp0 proto tcp to any port { 25 80 } ... blocks incoming email and http connections on the fxp0 interface. That is all you need to put in pf.conf to do that.
- bleu-ble-bleu 8y agoI agree. The syntax is very readable and easy to understand. With consumer firewalls being pwned all the time, OpenBSD with PF could be a good option for some people.
- ttul 8y agoI’m going to have to get it set up again... ahh the simplicity and robustness of OpenBSD...
- foodstances 8y agoI recommend using `egress` in a simple setup like that, it'll still work if you ever change your network device. block in on egress proto tcp to port { 25, 80 }
- petee 8y agoyes, you can, the command is called 'vi' :) block all pass proto tcp to port www