Packet Filter

Informations

/etc/pf.conf
/etc/examples/pf.conf

pfctl command

pfctl -nf /etc/pf.conf
pfctl -nvf /etc/pf.conf
pfctl -f /etc/pf.conf
pfctl -F rules
pfctl -F all
pfctl -s rules
pfctl -s info
pfctl -s all
pfctl -s state
pfctl -k host | network

Macros

tcp_services = "{ ssh, domain, www, https }"
pass out proto tcp to any port $tcp_services keep state

Enable PacketFilter at boot

pf=YES	#active PF
pf_rules=/etc/pf.conf	# tell where is the configuration file

Router mode

Enable router mode (temporary)

# sysctl net.inet.ip.forwarding=1
# sysctl net.inet6.ip6.forwarding=1

Enable router mode (permanent)

Edit /etc/sysctl.conf.

net.inet.ip.forwarding=1
net.inet6.ip6.forwarding=1

Examples

NAT (LAN to WAN) and ALLOW ALL

#MACROS
ext_if = "re0"
int_if = "re1"
localnet = $int_if:network

# NAT
match out on $ext_if from $localnet to any nat-to $ext_if

# FILTER RULES
block all
pass from { lo0, $localnet } to any keep state

NAT (LAN to WAN) and Packet Filtering

#MACROS
ext_if = "re0"
int_if = "re1"
client_out = "{ ftp-data, ftp, ssh, domain, pop3, auth, nntp, http, https, 446, cvspserver, 2628, 5999, 8000, 8080 }"
udp_services = "{ domain, ntp }"
localnet = $int_if:network

# NAT
match out on $ext_if from $localnet to any nat-to $ext_if
# FILTER RULES
block all
pass inet proto tcp from $localnet to any port $client_out keep state
pass quick inet proto { tcp, udp } from $localnet to any port $udp_services keep state

NAT (LAN to WAN), Redirection (Port Forwarding) and Packet Filtering

We only allow http, https and dns from our 192.168.2.0/24 network and we allow rdp connexion to a host inside our network from everywhere.

#MACROS
ext_if = "em0"
lan_if = "em1"
tcp_allow = "{ domain, http, https }"
udp_allow = "{ domain }"
lan_network = "{ 192.168.2.0/24 }"

set skip on lo

block return    # block stateless traffic
block in all
block out all
pass out on $ext_if             # establish keep-state

# NAT
pass out on $ext_if inet from $lan_if:network to any nat-to $ext_if
# RDR to allow RDP
pass in quick on $ext_if proto tcp from any to any port 3389 rdr-to 192.168.2.200 port 3389

# FILTER RULES
pass quick from self to $lan_if:network
pass in quick on $lan_if inet proto tcp from $lan_if:network to any port $tcp_allow modulate state
pass in quick on $lan_if inet proto udp from $lan_if:network to any port $udp_allow modulate state
pass out quick on $lan_if inet proto tcp from any to 192.168.2.218 port 3389 keep state

# allow ssh to OpenBSD :
pass quick inet proto tcp from any to self port 22


# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010
Licence Creative Commons
This website http://shebangthedolphins.net is licensed to the public under a licence Creative Commons Attribution licence.
Contact :