1.\" $OpenBSD: pf.conf.5,v 1.551 2016/01/05 22:51:38 benno Exp $ 2.\" 3.\" Copyright (c) 2002, Daniel Hartmeier 4.\" Copyright (c) 2003 - 2013 Henning Brauer <henning@openbsd.org> 5.\" All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 11.\" - Redistributions of source code must retain the above copyright 12.\" notice, this list of conditions and the following disclaimer. 13.\" - Redistributions in binary form must reproduce the above 14.\" copyright notice, this list of conditions and the following 15.\" disclaimer in the documentation and/or other materials provided 16.\" with the distribution. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19.\" "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 20.\" LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 21.\" FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 22.\" COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 23.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 24.\" BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 25.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 26.\" CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 28.\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29.\" POSSIBILITY OF SUCH DAMAGE. 30.\" 31.Dd $Mdocdate: January 5 2016 $ 32.Dt PF.CONF 5 33.Os 34.Sh NAME 35.Nm pf.conf 36.Nd packet filter configuration file 37.Sh DESCRIPTION 38The 39.Xr pf 4 40packet filter modifies, drops, or passes packets according to rules or 41definitions specified in 42.Nm . 43.Pp 44This is an overview of the sections in this manual page: 45.Bl -inset 46.It Sx PACKET FILTERING 47including network address translation (NAT). 48.It Sx OPTIONS 49globally tune the behaviour of the packet filtering engine. 50.It Sx QUEUEING 51provides rule-based bandwidth control. 52.It Sx TABLES 53provide a method for dealing with large numbers of addresses. 54.It Sx ANCHORS 55are containers for rules and tables. 56.It Sx STATEFUL FILTERING 57tracks packets by state. 58.It Sx TRAFFIC NORMALISATION 59includes scrub, fragment handling, and blocking spoofed traffic. 60.It Sx OPERATING SYSTEM FINGERPRINTING 61is a method for detecting a host's operating system. 62.It Sx EXAMPLES 63provides some example rulesets. 64.It Sx GRAMMAR 65provides a complete BNF grammar reference. 66.El 67.Pp 68The current line can be extended over multiple lines using a backslash 69.Pq Sq \e . 70Comments can be put anywhere in the file using a hash mark 71.Pq Sq # , 72and extend to the end of the current line. 73Care should be taken when commenting out multi-line text: 74the comment is effective until the end of the entire block. 75.Pp 76Argument names not beginning with a letter, digit, or underscore 77must be quoted. 78.Pp 79Additional configuration files can be included with the 80.Ic include 81keyword, for example: 82.Bd -literal -offset indent 83include "/etc/pf/sub.filter.conf" 84.Ed 85.Pp 86Macros can be defined that will later be expanded in context. 87Macro names must start with a letter, digit, or underscore, 88and may contain any of those characters. 89Macro names may not be reserved words (for example 90.Ic pass , 91.Cm in , 92.Cm out ) . 93Macros are not expanded inside quotes. 94.Pp 95For example: 96.Bd -literal -offset indent 97ext_if = "kue0" 98all_ifs = "{" $ext_if lo0 "}" 99pass out on $ext_if from any to any 100pass in on $ext_if proto tcp from any to any port 25 101.Ed 102.Sh PACKET FILTERING 103.Xr pf 4 104has the ability to 105.Ic block , 106.Ic pass , 107and 108.Ic match 109packets based on attributes of their layer 3 110and layer 4 headers. 111Filter rules determine which of these actions are taken; 112filter parameters specify the packets to which a rule applies. 113.Pp 114For each packet processed by the packet filter, the filter rules are 115evaluated in sequential order, from first to last. 116For 117.Ic block 118and 119.Ic pass , 120the last matching rule decides what action is taken; 121if no rule matches the packet, the default action is to pass 122the packet without creating a state. 123For 124.Ic match , 125rules are evaluated every time they match; 126the pass/block state of a packet remains unchanged. 127.Pp 128Most parameters are optional. 129If a parameter is specified, the rule only applies to packets with 130matching attributes. 131Certain parameters can be expressed as lists, in which case 132.Xr pfctl 8 133generates all needed rule combinations. 134.Pp 135By default 136.Xr pf 4 137filters packets statefully: 138the first time a packet matches a 139.Ic pass 140rule, a state entry is created. 141The packet filter examines each packet to see if it matches an existing state. 142If it does, the packet is passed without evaluation of any rules. 143After the connection is closed or times out, the state entry is automatically 144removed. 145.Pp 146The following actions can be used in the filter: 147.Bl -tag -width Ds 148.It Ic block 149The packet is blocked. 150There are a number of ways in which a 151.Ic block 152rule can behave when blocking a packet. 153The default behaviour is to 154.Cm drop 155packets silently, however this can be overridden or made 156explicit either globally, by setting the 157.Cm block-policy 158option, or on a per-rule basis with one of the following options: 159.Pp 160.Bl -tag -width return-icmp6 -compact 161.It Cm drop 162The packet is silently dropped. 163.It Cm return 164This causes a TCP RST to be returned for TCP packets 165and an ICMP UNREACHABLE for other types of packets. 166.It Cm return-icmp 167.It Cm return-icmp6 168This causes ICMP messages to be returned for packets which match the rule. 169By default this is an ICMP UNREACHABLE message, however this 170can be overridden by specifying a message as a code or number. 171.It Cm return-rst 172This applies only to TCP packets, 173and issues a TCP RST which closes the connection. 174An optional parameter, 175.Cm ttl , 176may be given with a TTL value. 177.El 178.Pp 179Options returning ICMP packets currently have no effect if 180.Xr pf 4 181operates on a 182.Xr bridge 4 , 183as the code to support this feature has not yet been implemented. 184.Pp 185The simplest mechanism to block everything by default and only pass 186packets that match explicit rules is specify a first filter rule of: 187.Pp 188.Dl block all 189.It Ic match 190The packet is matched. 191This mechanism is used to provide fine grained filtering 192without altering the block/pass state of a packet. 193.Ic match 194rules differ from 195.Ic block 196and 197.Ic pass 198rules in that parameters are set every time a packet matches the 199rule, not only on the last matching rule. 200For the following parameters, 201this means that the parameter effectively becomes 202.Dq sticky 203until explicitly overridden: 204.Cm nat-to , 205.Cm binat-to , 206.Cm rdr-to , 207.Cm queue , 208.Cm rtable , 209and 210.Cm scrub . 211.Pp 212.Cm log 213is different still, 214in that the action happens every time a rule matches 215i.e. a single packet can get logged more than once. 216.It Ic pass 217The packet is passed; 218state is created unless the 219.Cm no state 220option is specified. 221.El 222.Pp 223The following parameters can be used in the filter: 224.Bl -tag -width Ds 225.It Cm in No or Cm out 226A packet always comes in on, or goes out through, one interface. 227.Cm in 228and 229.Cm out 230apply to incoming and outgoing packets; 231if neither are specified, 232the rule will match packets in both directions. 233.It Cm log Op Cm all | matches | to Ar interface | Cm user 234In addition to any action specified, 235log the packet. 236Only the packet that establishes the state is logged, 237unless the 238.Cm no state 239option is specified. 240The logged packets are sent to a 241.Xr pflog 4 242interface, by default 243.Pa pflog0 ; 244pflog0 is monitored by the 245.Xr pflogd 8 246logging daemon which logs to the file 247.Pa /var/log/pflog 248in 249.Xr pcap 3 250binary format. 251.Pp 252The keywords 253.Cm all , matches , to , 254and 255.Cm user 256are all optional, 257and can be combined using commas. 258.Pp 259Use 260.Cm all 261to force logging of all packets for a connection. 262This is not necessary when 263.Cm no state 264is explicitly specified. 265.Pp 266If 267.Cm matches 268is specified, 269it logs the packet on all subsequent matching rules. 270It is often combined with 271.Cm to Ar interface 272to avoid adding noise to the default log file. 273.Pp 274The keyword 275.Cm user 276logs the UID and PID of the 277socket on the local host used to send or receive a packet, 278in addition to the normal information. 279.Pp 280To specify a logging interface other than 281.Pa pflog0 , 282use the syntax 283.Cm to Ar interface . 284.It Cm quick 285If a packet matches a rule which has the 286.Cm quick 287option set, this rule 288is considered the last matching rule, and evaluation of subsequent rules 289is skipped. 290.It Cm on Ar interface | Cm any 291This rule applies only to packets coming in on, or going out through, this 292particular interface or interface group. 293For more information on interface groups, 294see the 295.Ic group 296keyword in 297.Xr ifconfig 8 . 298.Cm any 299will match any existing interface except loopback ones. 300.It Cm on rdomain Ar number 301This rule applies only to packets coming in on, or going out through, this 302particular routing domain. 303.It Cm inet | inet6 304This rule applies only to packets of this address family. 305.It Cm proto Ar protocol 306This rule applies only to packets of this protocol. 307Common protocols are ICMP, ICMP6, TCP, and UDP. 308For a list of all the protocol name to number mappings used by 309.Xr pfctl 8 , 310see the file 311.Pa /etc/protocols . 312.It Xo 313.Cm from Ar source 314.Cm port Ar source 315.Cm os Ar source 316.Cm to Ar dest 317.Cm port Ar dest 318.Xc 319This rule applies only to packets with the specified source and destination 320addresses and ports. 321.Pp 322Addresses can be specified in CIDR notation (matching netblocks), as 323symbolic host names, interface names or interface group names, or as any 324of the following keywords: 325.Pp 326.Bl -tag -width urpf-failed -compact 327.It Cm any 328Any address. 329.It Cm no-route 330Any address which is not currently routable. 331.It Cm route Ar label 332Any address matching the given 333.Xr route 8 334.Ar label . 335.It Cm self 336Expands to all addresses assigned to all interfaces. 337.It Pf < Ar table Ns > 338Any address matching the given 339.Ar table . 340.It Cm urpf-failed 341Any source address that fails a unicast reverse path forwarding (URPF) 342check, i.e. packets coming in on an interface other than that which holds 343the route back to the packet's source address. 344.El 345.Pp 346Ranges of addresses are specified using the 347.Sq - 348operator. 349For instance: 350.Dq 10.1.1.10 - 10.1.1.12 351means all addresses from 10.1.1.10 to 10.1.1.12, 352hence addresses 10.1.1.10, 10.1.1.11, and 10.1.1.12. 353.Pp 354Interface names, interface group names, and 355.Cm self 356can have modifiers appended: 357.Pp 358.Bl -tag -width :broadcast -compact 359.It Cm :0 360Do not include interface aliases. 361.It Cm :broadcast 362Translates to the interface's broadcast address(es). 363.It Cm :network 364Translates to the network(s) attached to the interface. 365.It Cm :peer 366Translates to the point-to-point interface's peer address(es). 367.El 368.Pp 369Host names may also have the 370.Cm :0 371modfier appended to restrict the name resolution to the first of each 372v4 and v6 address found. 373.Pp 374Host name resolution and interface to address translation are done at 375ruleset load-time. 376When the address of an interface (or host name) changes (under DHCP or PPP, 377for instance), the ruleset must be reloaded for the change to be reflected 378in the kernel. 379Surrounding the interface name (and optional modifiers) in parentheses 380changes this behaviour. 381When the interface name is surrounded by parentheses, the rule is 382automatically updated whenever the interface changes its address. 383The ruleset does not need to be reloaded. 384This is especially useful with NAT. 385.Pp 386Ports can be specified either by number or by name. 387For example, port 80 can be specified as 388.Cm www . 389For a list of all port name to number mappings used by 390.Xr pfctl 8 , 391see the file 392.Pa /etc/services . 393.Pp 394Ports and ranges of ports are specified using these operators: 395.Bd -literal -offset indent 396= (equal) 397!= (unequal) 398< (less than) 399<= (less than or equal) 400> (greater than) 401>= (greater than or equal) 402: (range including boundaries) 403>< (range excluding boundaries) 404<> (except range) 405.Ed 406.Pp 407.Sq >< , 408.Sq <> 409and 410.Sq \&: 411are binary operators (they take two arguments). 412For instance: 413.Bl -tag -width Ds 414.It Li port 2000:2004 415means 416.Sq all ports \(>= 2000 and \(<= 2004 , 417hence ports 2000, 2001, 2002, 2003, and 2004. 418.It Li port 2000 >< 2004 419means 420.Sq all ports > 2000 and < 2004 , 421hence ports 2001, 2002, and 2003. 422.It Li port 2000 <> 2004 423means 424.Sq all ports < 2000 or > 2004 , 425hence ports 1\(en1999 and 2005\(en65535. 426.El 427.Pp 428The operating system of the source host can be specified in the case of TCP 429rules with the 430.Cm os 431modifier. 432See the 433.Sx OPERATING SYSTEM FINGERPRINTING 434section for more information. 435.Pp 436The 437.Cm host , 438.Cm port , 439and 440.Cm os 441specifications are optional, as in the following examples: 442.Bd -literal -offset indent 443pass in all 444pass in from any to any 445pass in proto tcp from any port < 1024 to any 446pass in proto tcp from any to any port 25 447pass in proto tcp from 10.0.0.0/8 port >= 1024 \e 448 to ! 10.1.2.3 port != ssh 449pass in proto tcp from any os "OpenBSD" 450pass in proto tcp from route "DTAG" 451.Ed 452.El 453.Pp 454The following additional parameters can be used in the filter: 455.Pp 456.Bl -tag -width Ds -compact 457.It Cm all 458This is equivalent to 459.Ql from any to any . 460.Pp 461.It Cm allow-opts 462By default, IPv4 packets with IP options or IPv6 packets with routing 463extension headers are blocked. 464When 465.Cm allow-opts 466is specified for a 467.Ic pass 468rule, packets that pass the filter based on that rule (last matching) 469do so even if they contain IP options or routing extension headers. 470For packets that match state, the rule that initially created the 471state is used. 472The implicit pass rule that is used when a packet does not match 473any rules does not allow IP options. 474.Pp 475.It Cm divert-packet port Ar port 476Used to send matching packets to 477.Xr divert 4 478sockets bound to port 479.Ar port . 480If the default option of fragment reassembly is enabled, scrubbing with 481.Cm reassemble tcp 482is also enabled for 483.Cm divert-packet 484rules. 485.Pp 486.It Cm divert-reply 487Used to receive replies for sockets that are bound to addresses 488which are not local to the machine. 489See 490.Xr setsockopt 2 491for information on how to bind these sockets. 492.Pp 493.It Cm divert-to Ar host Cm port Ar port 494Used to redirect packets to a local socket bound to 495.Ar host 496and 497.Ar port . 498The packets will not be modified, so 499.Xr getsockname 2 500on the socket will return the original destination address of the packet. 501.Pp 502.It Cm flags Ar a Ns / Ns Ar b | Cm any 503This rule only applies to TCP packets that have the flags 504.Ar a 505set out of set 506.Ar b . 507Flags not specified in 508.Ar b 509are ignored. 510For stateful connections, the default is 511.Cm flags S/SA . 512To indicate that flags should not be checked at all, specify 513.Cm flags any . 514The flags are: (F)IN, (S)YN, (R)ST, (P)USH, (A)CK, (U)RG, (E)CE, and C(W)R. 515.Bl -tag -width "flags /SFRA" 516.It Cm flags S/S 517Flag SYN is set. 518The other flags are ignored. 519.It Cm flags S/SA 520This is the default setting for stateful connections. 521Out of SYN and ACK, exactly SYN may be set. 522SYN, SYN+PSH, and SYN+RST match, but SYN+ACK, ACK, and ACK+RST do not. 523This is more restrictive than the previous example. 524.It Cm flags /SFRA 525If the first set is not specified, it defaults to none. 526All of SYN, FIN, RST, and ACK must be unset. 527.El 528.Pp 529Because 530.Cm flags S/SA 531is applied by default (unless 532.Cm no state 533is specified), only the initial SYN packet of a TCP handshake will create 534a state for a TCP connection. 535It is possible to be less restrictive, and allow state creation from 536intermediate 537.Pq non-SYN 538packets, by specifying 539.Cm flags any . 540This will cause 541.Xr pf 4 542to synchronize to existing connections, for instance 543if one flushes the state table. 544However, states created from such intermediate packets may be missing 545connection details such as the TCP window scaling factor. 546States which modify the packet flow, such as those affected by 547.Cm af-to , 548.Cm modulate state , 549.Cm nat-to , 550.Cm rdr-to , 551or 552.Cm synproxy state 553options, or scrubbed with 554.Cm reassemble tcp , 555will also not be recoverable from intermediate packets. 556Such connections will stall and time out. 557.Pp 558.It Cm group Ar group 559Similar to 560.Cm user , 561this rule only applies to packets of sockets owned by the specified 562.Ar group . 563.Pp 564.It Cm icmp-type Ar type Cm code Ar code 565.It Cm icmp6-type Ar type Cm code Ar code 566This rule only applies to ICMP or ICMP6 packets with the specified type 567and code. 568Text names for ICMP types and codes are listed in 569.Xr icmp 4 570and 571.Xr icmp6 4 . 572The protocol and the ICMP type indicator 573.Po 574.Cm icmp-type 575or 576.Cm icmp6-type 577.Pc 578must match. 579.Pp 580.It Cm label Ar string 581Adds a label to the rule, which can be used to identify the rule. 582For instance, 583.Ql pfctl -s labels 584shows per-rule statistics for rules that have labels. 585.Pp 586The following macros can be used in labels: 587.Pp 588.Bl -tag -width "$srcaddrXXX" -compact -offset indent 589.It Va $dstaddr 590The destination IP address. 591.It Va $dstport 592The destination port specification. 593.It Va $if 594The interface. 595.It Va $nr 596The rule number. 597.It Va $proto 598The protocol name. 599.It Va $srcaddr 600The source IP address. 601.It Va $srcport 602The source port specification. 603.El 604.Pp 605For example: 606.Bd -literal -offset indent -compact 607ips = "{ 1.2.3.4, 1.2.3.5 }" 608pass in proto tcp from any to $ips \e 609 port > 1023 label "$dstaddr:$dstport" 610.Ed 611.Pp 612Expands to: 613.Bd -literal -offset indent -compact 614pass in inet proto tcp from any to 1.2.3.4 \e 615 port > 1023 label "1.2.3.4:>1023" 616pass in inet proto tcp from any to 1.2.3.5 \e 617 port > 1023 label "1.2.3.5:>1023" 618.Ed 619.Pp 620The macro expansion for the 621.Cm label 622directive occurs only at configuration file parse time, not during runtime. 623.Pp 624.It Cm once 625Creates a one shot rule that will remove itself from an active ruleset after 626the first match. 627In case this is the only rule in the anchor, the anchor will be destroyed 628automatically after the rule is matched. 629.Pp 630.It Cm probability Ar number Ns % 631A probability attribute can be attached to a rule, 632with a value set between 0 and 100%, 633in which case the rule is honoured using the given probability value. 634For example, the following rule will drop 20% of incoming ICMP packets: 635.Pp 636.Dl block in proto icmp probability 20% 637.Pp 638.It Cm prio Ar number 639Only match packets which have the given queueing priority assigned. 640.Pp 641.It Cm received-on Ar interface 642Only match packets which were received on the specified 643.Cm interface 644(or interface group). 645.Cm any 646will match any existing interface except loopback ones. 647.Pp 648.It Cm rtable Ar number 649Used to select an alternate routing table for the routing lookup. 650Only effective before the route lookup happened, i.e. when filtering inbound. 651.Pp 652.It Cm set prio Ar priority | Pq Ar priority , priority 653Packets matching this rule will be assigned a specific queueing priority. 654Priorities are assigned as integers 0 through 7, 655with a default priority of 3. 656If the packet is transmitted on a 657.Xr vlan 4 658interface, the queueing priority will also be written as the priority 659code point in the 802.1Q VLAN header. 660If two priorities are given, packets which have a TOS of 661.Cm lowdelay 662and TCP ACKs with no data payload will be assigned to the second one. 663Packets with a higher priority number are processed first, 664and packets with the same priority are processed 665in the order in which they are received. 666.Pp 667For example: 668.Bd -literal -offset indent 669pass in proto tcp to port 25 set prio 2 670pass in proto tcp to port 22 set prio (2, 5) 671.Ed 672.Pp 673The interface priority queues accessed by the 674.Cm set prio 675keyword are always enabled and do not require any additional 676configuration, unlike the queues described below and in the 677.Sx QUEUEING 678section. 679.Pp 680.It Cm set queue Ar queue | Pq Ar queue , queue 681Packets matching this rule will be assigned to the specified 682.Ar queue . 683If two queues are given, packets which have a TOS of 684.Cm lowdelay 685and TCP ACKs with no data payload will be assigned to the second one. 686See 687.Sx QUEUEING 688for setup details. 689.Pp 690For example: 691.Bd -literal -offset indent 692pass in proto tcp to port 25 set queue mail 693pass in proto tcp to port 22 set queue(ssh_bulk, ssh_prio) 694.Ed 695.Pp 696.It Cm set tos Ar string | number 697Enforces a TOS for matching packets. 698.Ar string 699may be one of 700.Cm critical , 701.Cm inetcontrol , 702.Cm lowdelay , 703.Cm netcontrol , 704.Cm throughput , 705.Cm reliability , 706or one of the DiffServ Code Points: 707.Cm ef , 708.Cm af11 No ... Cm af43 , 709.Cm cs0 No ... Cm cs7 ; 710.Ar number 711may be either a hex or decimal number. 712.Pp 713.It Cm tag Ar string 714Packets matching this rule will be tagged with the specified 715.Ar string . 716The tag acts as an internal marker that can be used to 717identify these packets later on. 718This can be used, for example, to provide trust between 719interfaces and to determine if packets have been 720processed by translation rules. 721Tags are 722.Dq sticky , 723meaning that the packet will be tagged even if the rule 724is not the last matching rule. 725Further matching rules can replace the tag with a 726new one but will not remove a previously applied tag. 727A packet is only ever assigned one tag at a time. 728Tags take the same macros as labels (see above). 729.Pp 730.It Oo Cm \&! Oc Ns Cm tagged Ar string 731Used with filter or translation rules 732to specify that packets must already 733be tagged with the given 734.Ar string 735in order to match the rule. 736Inverse tag matching can also be done 737by specifying the 738.Cm !\& 739operator before the 740.Cm tagged 741keyword. 742.Pp 743.It Cm tos Ar string | number 744This rule applies to packets with the specified TOS bits set. 745.Ar string 746may be one of 747.Cm critical , 748.Cm inetcontrol , 749.Cm lowdelay , 750.Cm netcontrol , 751.Cm throughput , 752.Cm reliability , 753or one of the DiffServ Code Points: 754.Cm ef , 755.Cm af11 No ... Cm af43 , 756.Cm cs0 No ... Cm cs7 ; 757.Ar number 758may be either a hex or decimal number. 759.Pp 760For example, the following rules are identical: 761.Bd -literal -offset indent 762pass all tos lowdelay 763pass all tos 0x10 764pass all tos 16 765.Ed 766.Pp 767.It Cm user Ar user 768This rule only applies to packets of sockets owned by the specified 769.Ar user . 770For outgoing connections initiated from the firewall, this is the user 771that opened the connection. 772For incoming connections to the firewall itself, this is the user that 773listens on the destination port. 774.Pp 775When listening sockets are bound to the wildcard address, 776.Xr pf 4 777cannot determine if a connection is destined for the firewall itself. 778To avoid false matches on just the destination port, combine a 779.Cm user 780rule with source or destination address 781.Cm self . 782.Pp 783All packets, both outgoing and incoming, of one connection are associated 784with the same user and group. 785Only TCP and UDP packets can be associated with users. 786.Pp 787The 788.Ar user 789and 790.Ar group 791arguments refer to the effective (as opposed to the real) IDs, in 792case the socket is created by a setuid/setgid process. 793User and group IDs are stored when a socket is created; 794when a process creates a listening socket as root (for instance, by 795binding to a privileged port) and subsequently changes to another 796user ID (to drop privileges), the credentials will remain root. 797.Pp 798User and group IDs can be specified as either numbers or names. 799The syntax is similar to the one for ports. 800The following example allows only selected users to open outgoing 801connections: 802.Bd -literal -offset indent 803block out proto tcp all 804pass out proto tcp from self user { < 1000, dhartmei } 805.Ed 806.El 807.Ss Translation 808Translation options modify either the source or destination address and 809port of the packets associated with a stateful connection. 810.Xr pf 4 811modifies the specified address and/or port in the packet and recalculates 812IP, TCP, and UDP checksums as necessary. 813.Pp 814Subsequent rules will see packets as they look 815after any addresses and ports have been translated. 816These rules will therefore have to filter based on the translated 817address and port number. 818.Pp 819The state entry created permits 820.Xr pf 4 821to keep track of the original address for traffic associated with that state 822and correctly direct return traffic for that connection. 823.Pp 824Different types of translation are possible with pf: 825.Bl -tag -width binat-to 826.It Cm af-to 827Translation between different address families (NAT64) is handled 828using 829.Cm af-to 830rules. 831Because address family translation overrides the routing table, it's 832only possible to use 833.Cm af-to 834on inbound rules, and a source address for the resulting translation 835must always be specified. 836.Pp 837The optional second argument is the host or subnet the original 838addresses are translated into for the destination. 839The lowest bits of the original destination address form the host 840part of the new destination address according to the specified subnet. 841It is possible to embed a complete IPv4 address into an IPv6 address 842using a network prefix of /96 or smaller. 843.Pp 844When a destination address is not specified it is assumed that the host 845part is 32-bit long. 846For IPv6 to IPv4 translation this would mean using only the lower 32 847bits of the original IPv6 destination address. 848For IPv4 to IPv6 translation the destination subnet defaults to the 849subnet of the new IPv6 source address with a prefix length of /96. 850See RFC 6052 Section 2.2 for details on how the prefix determines the 851destination address encoding. 852.Pp 853For example, the following rules are identical: 854.Bd -literal -offset indent 855pass in inet af-to inet6 from 2001:db8::1 to 2001:db8::/96 856pass in inet af-to inet6 from 2001:db8::1 857.Ed 858.Pp 859In the above example the matching IPv4 packets will be modified to 860have a source address of 2001:db8::1 and a destination address will 861get prefixed with 2001:db8::/96, e.g. 198.51.100.100 will be 862translated to 2001:db8::c633:6464. 863.Pp 864In the reverse case the following rules are identical: 865.Bd -literal -offset indent 866pass in inet6 af-to inet from 198.51.100.1 to 0.0.0.0/0 867pass in inet6 af-to inet from 198.51.100.1 868.Ed 869.Pp 870The destination IPv4 address is assumed to be embedded inside the 871original IPv6 destination address, e.g. 64:ff9b::c633:6464 will be 872translated to 198.51.100.100. 873.Pp 874The current implementation will only extract IPv4 addresses from the 875IPv6 addresses with a prefix length of /96 and greater. 876.It Cm binat-to 877A 878.Cm binat-to 879rule specifies a bidirectional mapping between an external IP 880netblock and an internal IP netblock. 881It expands to an outbound 882.Cm nat-to 883rule and an inbound 884.Cm rdr-to 885rule. 886.It Cm nat-to 887A 888.Cm nat-to 889option specifies that IP addresses are to be changed as the packet 890traverses the given interface. 891This technique allows one or more IP addresses 892on the translating host to support network traffic for a larger range of 893machines on an 894.Dq inside 895network. 896Although in theory any IP address can be used on the inside, it is strongly 897recommended that one of the address ranges defined by RFC 1918 be used. 898Those netblocks are: 899.Bd -literal -offset indent 90010.0.0.0 \(en 10.255.255.255 (all of net 10, i.e. 10/8) 901172.16.0.0 \(en 172.31.255.255 (i.e. 172.16/12) 902192.168.0.0 \(en 192.168.255.255 (i.e. 192.168/16) 903.Ed 904.Pp 905.Cm nat-to 906is usually applied outbound. 907If applied inbound, nat-to to a local IP address is not supported. 908.It Cm rdr-to 909The packet is redirected to another destination and possibly a 910different port. 911.Cm rdr-to 912can optionally specify port ranges instead of single ports. 913For instance: 914.Bl -tag -width Ds 915.It match in ... port 2000:2999 rdr-to ... port 4000 916redirects ports 2000 to 2999 (inclusive) to port 4000. 917.It match in ... port 2000:2999 rdr-to ... port 4000:* 918redirects port 2000 to 4000, port 2001 to 4001, ..., port 2999 to 4999. 919.El 920.Pp 921.Cm rdr-to 922is usually applied inbound. 923If applied outbound, rdr-to to a local IP address is not supported. 924.El 925.Pp 926In addition to modifying the address, some translation rules may modify 927source or destination ports for TCP or UDP connections; 928implicitly in the case of 929.Cm nat-to 930options and explicitly in the case of 931.Cm rdr-to 932ones. 933Port numbers are never translated with a 934.Cm binat-to 935rule. 936.Pp 937Translation options apply only to packets that pass through the specified 938interface, and if no interface is specified, translation is applied 939to packets on all interfaces. 940For instance, redirecting port 80 on an external interface to an internal 941web server will only work for connections originating from the outside. 942Connections to the address of the external interface from local hosts will 943not be redirected, since such packets do not actually pass through the 944external interface. 945Redirections cannot reflect packets back through the interface they arrive 946on, they can only be redirected to hosts connected to different interfaces 947or to the firewall itself. 948.Pp 949However packets may be redirected to hosts connected to the interface the 950packet arrived on by using redirection with NAT. 951For example: 952.Bd -literal -offset indent 953pass in on $int_if proto tcp from $int_net to $ext_if port 80 \e 954 rdr-to $server 955pass out on $int_if proto tcp to $server port 80 \e 956 received-on $int_if nat-to $int_if 957.Ed 958.Pp 959Note that redirecting external incoming connections to the loopback address 960will effectively allow an external host to connect to daemons 961bound solely to the loopback address, circumventing the traditional 962blocking of such connections on a real interface. 963For example: 964.Bd -literal -offset indent 965pass in on egress proto tcp from any to any port smtp \e 966 rdr-to 127.0.0.1 port spamd 967.Ed 968.Pp 969Unless this effect is desired, any of the local non-loopback addresses 970should be used instead as the redirection target, which allows external 971connections only to daemons bound to this address or not bound to 972any address. 973.Pp 974For 975.Cm af-to , 976.Cm nat-to 977and 978.Cm rdr-to 979options for which there is a single redirection address which has a 980subnet mask smaller than 32 for IPv4 or 128 for IPv6 (more than one IP 981address), a variety of different methods for assigning this address can be 982used: 983.Bl -tag -width xxxx 984.It Cm bitmask 985The 986.Cm bitmask 987option applies the network portion of the redirection address to the address 988to be modified (source with 989.Cm nat-to , 990destination with 991.Cm rdr-to ) . 992.It Cm least-states Op Cm sticky-address 993The 994.Cm least-states 995option selects the address with the least active states from 996a given address pool and considers given weights 997associated with address(es). 998Weights can be specified between 1 and 65535. 999Addresses with higher weights are selected more often. 1000.Pp 1001.Cm sticky-address 1002can be specified to ensure that multiple connections from the 1003same source are mapped to the same redirection address. 1004Associations are destroyed as soon as there are 1005no longer states which refer to them; 1006in order to make the mappings last 1007beyond the lifetime of the states, 1008increase the global options with 1009.Ic set Cm timeout src.track . 1010.It Cm random Op Cm sticky-address 1011The 1012.Cm random 1013option selects an address at random within the defined block of addresses. 1014.Cm sticky-address 1015is as described above. 1016.It Cm round-robin Op Cm sticky-address 1017The 1018.Cm round-robin 1019option loops through the redirection address(es) and considers given weights 1020associated with address(es). 1021Weights can be specified between 1 and 65535. 1022Addresses with higher weights are selected more often. 1023.Cm sticky-address 1024is as described above. 1025.It Cm source-hash Op Ar key 1026The 1027.Cm source-hash 1028option uses a hash of the source address to determine the redirection address, 1029ensuring that the redirection address is always the same for a given source. 1030An optional 1031.Ar key 1032can be specified after this keyword either in hex or as a string; 1033by default 1034.Xr pfctl 8 1035randomly generates a key for source-hash every time the 1036ruleset is reloaded. 1037.It Cm static-port 1038With 1039.Cm nat-to 1040rules, the 1041.Cm static-port 1042option prevents 1043.Xr pf 4 1044from modifying the source port on TCP and UDP packets. 1045.El 1046.Pp 1047When more than one redirection address or a table is specified, 1048.Cm bitmask 1049is not permitted as a pool type. 1050.Ss Routing 1051If a packet matches a rule with one of the following route options set, 1052the packet filter will route the packet according to the type of route option. 1053When such a rule creates state, the route option is also applied to all 1054packets matching the same connection. 1055.Bl -tag -width route-to 1056.It Cm dup-to 1057The 1058.Cm dup-to 1059option creates a duplicate of the packet and routes it like 1060.Cm route-to . 1061The original packet gets routed as it normally would. 1062.It Cm reply-to 1063The 1064.Cm reply-to 1065option is similar to 1066.Cm route-to , 1067but routes packets that pass in the opposite direction (replies) to the 1068specified interface. 1069Opposite direction is only defined in the context of a state entry, and 1070.Cm reply-to 1071is useful only in rules that create state. 1072It can be used on systems with multiple external connections to 1073route all outgoing packets of a connection through the interface 1074the incoming connection arrived through (symmetric routing enforcement). 1075.It Cm route-to 1076The 1077.Cm route-to 1078option routes the packet to the specified interface with an optional address 1079for the next hop. 1080When a 1081.Cm route-to 1082rule creates state, only packets that pass in the same direction as the 1083filter rule specifies will be routed in this way. 1084Packets passing in the opposite direction (replies) are not affected 1085and are routed normally. 1086.El 1087.Pp 1088For the 1089.Cm dup-to , 1090.Cm reply-to , 1091and 1092.Cm route-to 1093route options 1094for which there is a single redirection address which has a 1095subnet mask smaller than 32 for IPv4 or 128 for IPv6 (more than one IP 1096address), 1097the methods 1098.Cm least-states , 1099.Cm random , 1100.Cm round-robin , 1101and 1102.Cm source-hash , 1103as described above, 1104can be used. 1105.Sh OPTIONS 1106.Xr pf 4 1107may be tuned for various situations using the 1108.Ic set 1109command. 1110.Bl -tag -width Ds 1111.It Ic set Cm block-policy drop | return 1112The 1113.Cm block-policy 1114option sets the default behaviour for the packet 1115.Ic block 1116action: 1117.Pp 1118.Bl -tag -width return -compact 1119.It Cm drop 1120Packet is silently dropped. 1121.It Cm return 1122A TCP RST is returned for blocked TCP packets, 1123an ICMP UNREACHABLE is returned for blocked UDP packets, 1124and all other packets are silently dropped. 1125.El 1126.It Ic set Cm debug Ar level 1127Set the debug 1128.Ar level , 1129which limits the severity of log messages printed by 1130.Xr pf 4 . 1131This should be a keyword from the following ordered list 1132(highest to lowest): 1133.Cm emerg , 1134.Cm alert , 1135.Cm crit , 1136.Cm err , 1137.Cm warning , 1138.Cm notice , 1139.Cm info , 1140and 1141.Cm debug . 1142These keywords correspond to the similar (LOG_) values specified to the 1143.Xr syslog 3 1144library routine. 1145.It Cm set Cm fingerprints Ar filename 1146Load fingerprints of known operating systems from the given 1147.Ar filename . 1148By default fingerprints of known operating systems are automatically 1149loaded from 1150.Xr pf.os 5 , 1151but can be overridden via this option. 1152Setting this option may leave a small period of time where the fingerprints 1153referenced by the currently active ruleset are inconsistent until the new 1154ruleset finishes loading. 1155.It Ic set Cm hostid Ar number 1156The 32-bit hostid 1157.Ar number 1158identifies this firewall's state table entries to other firewalls 1159in a 1160.Xr pfsync 4 1161failover cluster. 1162By default the hostid is set to a pseudo-random value, however it may be 1163desirable to manually configure it, for example to more easily identify the 1164source of state table entries. 1165The hostid may be specified in either decimal or hexadecimal. 1166.It Ic set Cm limit Ar limit-item number 1167Sets hard limits on the memory pools used by the packet filter. 1168See 1169.Xr pool 9 1170for an explanation of memory pools. 1171.Pp 1172For example, 1173to set the maximum number of entries in the memory pool used by state table 1174entries (generated by 1175.Ic pass 1176rules which do not specify 1177.Cm no state ) 1178to 20000: 1179.Pp 1180.Dl set limit states 20000 1181.Pp 1182To set the maximum number of entries in the memory pool used for fragment 1183reassembly to 2000: 1184.Pp 1185.Dl set limit frags 2000 1186.Pp 1187This maximum may not exceed, and should be well below, the maximum number 1188of mbuf clusters 1189.Pq sysctl kern.maxclusters 1190in the system. 1191.Pp 1192To set the maximum number of entries in the memory pool used for tracking 1193source IP addresses (generated by the 1194.Cm sticky-address 1195and 1196.Cm src.track 1197options) to 2000: 1198.Pp 1199.Dl set limit src-nodes 2000 1200.Pp 1201To set limits on the memory pools used by tables: 1202.Bd -literal -offset indent 1203set limit tables 1000 1204set limit table-entries 100000 1205.Ed 1206.Pp 1207The first limits the number of tables that can exist to 1000. 1208The second limits the overall number of addresses that can be stored 1209in tables to 100000. 1210.Pp 1211Various limits can be combined on a single line: 1212.Bd -literal -offset indent 1213set limit { states 20000, frags 2000, src-nodes 2000 } 1214.Ed 1215.It Ic set Cm loginterface Ar interface | Cm none 1216Enable collection of packet and byte count statistics for the given 1217interface or interface group. 1218These statistics can be viewed using: 1219.Pp 1220.Dl # pfctl -s info 1221.Pp 1222In this example 1223.Xr pf 4 1224collects statistics on the interface named dc0: 1225.Pp 1226.Dl set loginterface dc0 1227.Pp 1228One can disable the loginterface using: 1229.Pp 1230.Dl set loginterface none 1231.It Ic set Cm optimization Ar environment 1232Optimize state timeouts for one of the following network environments: 1233.Pp 1234.Bl -tag -width Ds -compact 1235.It Cm aggressive 1236Aggressively expire connections. 1237This can greatly reduce the memory usage of the firewall at the cost of 1238dropping idle connections early. 1239.It Cm conservative 1240Extremely conservative settings. 1241Avoid dropping legitimate connections at the 1242expense of greater memory utilization (possibly much greater on a busy 1243network) and slightly increased processor utilization. 1244.It Cm high-latency 1245A high-latency environment (such as a satellite connection). 1246.It Cm normal 1247A normal network environment. 1248Suitable for almost all networks. 1249.It Cm satellite 1250Alias for 1251.Cm high-latency . 1252.El 1253.It Ic set Cm reassemble yes | no Op Cm no-df 1254The 1255.Cm reassemble 1256option is used to enable or disable the reassembly of fragmented packets, 1257and can be set to 1258.Cm yes 1259(the default) or 1260.Cm no . 1261If 1262.Cm no-df 1263is also specified, fragments with the 1264.Dq dont-fragment 1265bit set are reassembled too, 1266instead of being dropped; 1267the reassembled packet will have the 1268.Dq dont-fragment 1269bit cleared. 1270.It Ic set Cm ruleset-optimization Ar level 1271.Bl -tag -width profile -compact 1272.It Cm basic 1273Enable basic ruleset optimization. 1274This is the default behaviour. 1275Basic ruleset optimization does four things to improve the 1276performance of ruleset evaluations: 1277.Pp 1278.Bl -enum -compact 1279.It 1280remove duplicate rules 1281.It 1282remove rules that are a subset of another rule 1283.It 1284combine multiple rules into a table when advantageous 1285.It 1286re-order the rules to improve evaluation performance 1287.El 1288.Pp 1289.It Cm none 1290Disable the ruleset optimizer. 1291.It Cm profile 1292Uses the currently loaded ruleset as a feedback profile to tailor the 1293ordering of 1294.Cm quick 1295rules to actual network traffic. 1296.El 1297.Pp 1298It is important to note that the ruleset optimizer will modify the ruleset 1299to improve performance. 1300A side effect of the ruleset modification is that per-rule accounting 1301statistics will have different meanings than before. 1302If per-rule accounting is important for billing purposes or whatnot, 1303either the ruleset optimizer should not be used or a label field should 1304be added to all of the accounting rules to act as optimization barriers. 1305.Pp 1306Optimization can also be set as a command-line argument to 1307.Xr pfctl 8 , 1308overriding the settings in 1309.Nm . 1310.It Ic set Cm skip on Ar ifspec 1311List interfaces for which packets should not be filtered. 1312Packets passing in or out on such interfaces are passed as if pf was 1313disabled, i.e. pf does not process them in any way. 1314This can be useful on loopback and other virtual interfaces, when 1315packet filtering is not desired and can have unexpected effects. 1316.Ar ifspec 1317is only evaluated when the ruleset is loaded; interfaces created 1318later will not be skipped. 1319.It Ic set Cm state-defaults Ar state-option , ... 1320The 1321.Cm state-defaults 1322option sets the state options for states created from rules 1323without an explicit 1324.Cm keep state . 1325For example: 1326.Pp 1327.Dl set state-defaults pflow, no-sync 1328.It Ic set Cm state-policy if-bound | floating 1329The 1330.Cm state-policy 1331option sets the default behaviour for states: 1332.Pp 1333.Bl -tag -width if-bound -compact 1334.It Cm if-bound 1335States are bound to an interface. 1336.It Cm floating 1337States can match packets on any interfaces (the default). 1338.El 1339.It Ic set Cm timeout Ar variable value 1340.Bl -tag -width "src.track" -compact 1341.It Cm frag 1342Seconds before an unassembled fragment is expired. 1343.It Cm interval 1344Interval between purging expired states and fragments. 1345.It Cm src.track 1346Length of time to retain a source tracking entry after the last state 1347expires. 1348.El 1349.Pp 1350When a packet matches a stateful connection, the seconds to live for the 1351connection will be updated to that of the 1352protocol and modifier 1353which corresponds to the connection state. 1354Each packet which matches this state will reset the TTL. 1355Tuning these values may improve the performance of the 1356firewall at the risk of dropping valid idle connections. 1357.Pp 1358.Bl -tag -width Ds -compact 1359.It Cm tcp.closed 1360The state after one endpoint sends an RST. 1361.It Cm tcp.closing 1362The state after the first FIN has been sent. 1363.It Cm tcp.established 1364The fully established state. 1365.It Cm tcp.finwait 1366The state after both FINs have been exchanged and the connection is closed. 1367Some hosts (notably web servers on Solaris) send TCP packets even after closing 1368the connection. 1369Increasing 1370.Cm tcp.finwait 1371(and possibly 1372.Cm tcp.closing ) 1373can prevent blocking of such packets. 1374.It Cm tcp.first 1375The state after the first packet. 1376.It Cm tcp.opening 1377The state after the second packet but before both endpoints have 1378acknowledged the connection. 1379.El 1380.Pp 1381ICMP and UDP are handled in a fashion similar to TCP, but with a much more 1382limited set of states: 1383.Pp 1384.Bl -tag -width Ds -compact 1385.It Cm icmp.error 1386The state after an ICMP error came back in response to an ICMP packet. 1387.It Cm icmp.first 1388The state after the first packet. 1389.It Cm udp.first 1390The state after the first packet. 1391.It Cm udp.multiple 1392The state if both hosts have sent packets. 1393.It Cm udp.single 1394The state if the source host sends more than one packet but the destination 1395host has never sent one back. 1396.El 1397.Pp 1398Other protocols are handled similarly to UDP: 1399.Pp 1400.Bl -tag -width xxxx -compact 1401.It Cm other.first 1402.It Cm other.multiple 1403.It Cm other.single 1404.El 1405.Pp 1406Timeout values can be reduced adaptively as the number of state table 1407entries grows. 1408.Pp 1409.Bl -tag -width Ds -compact 1410.It Cm adaptive.end 1411When reaching this number of state entries, all timeout values become 1412zero, effectively purging all state entries immediately. 1413This value is used to define the scale factor; it should not actually 1414be reached (set a lower state limit, see below). 1415.It Cm adaptive.start 1416When the number of state entries exceeds this value, adaptive scaling 1417begins. 1418All timeout values are scaled linearly with factor 1419(adaptive.end \- number of states) / (adaptive.end \- adaptive.start). 1420.El 1421.Pp 1422Adaptive timeouts are enabled by default, with an adaptive.start value 1423equal to 60% of the state limit, and an adaptive.end value equal to 1424120% of the state limit. 1425They can be disabled by setting both adaptive.start and adaptive.end to 0. 1426.Pp 1427The adaptive timeout values can be defined both globally and for each rule. 1428When used on a per-rule basis, the values relate to the number of 1429states created by the rule, otherwise to the total number of 1430states. 1431.Pp 1432For example: 1433.Bd -literal -offset indent 1434set timeout tcp.first 120 1435set timeout tcp.established 86400 1436set timeout { adaptive.start 6000, adaptive.end 12000 } 1437set limit states 10000 1438.Ed 1439.Pp 1440With 9000 state table entries, the timeout values are scaled to 50% 1441(tcp.first 60, tcp.established 43200). 1442.El 1443.Sh QUEUEING 1444Packets can be assigned to queues for the purpose of bandwidth 1445control. 1446At least one declaration is required to configure queues, and later 1447any packet filtering rule can reference the defined queues by name. 1448During the filtering component of 1449.Nm , 1450the last referenced 1451.Ar queue 1452name is where any passed packets will be queued, while for 1453blocked packets it specifies where any resulting ICMP or TCP RST 1454packets should be queued. 1455If the referenced queue does not exist on the outgoing interface the 1456default queue for that interface is used. 1457Queues attached to an interface build a tree, 1458thus each queue can have further child queues. 1459Only leaf queues, i.e. queues without children, can be used to assign 1460packets to. 1461The root queue must specifically reference an interface, all other queues 1462pick up the interface(s) they should be created on from their parent queues 1463unless explicitly specified. 1464.Pp 1465In the following example, a queue named std is created on the interface em0, 1466with 3 child queues ssh, mail and http. 1467.Bd -literal -offset indent 1468queue std on em0 bandwidth 100M 1469queue ssh parent std bandwidth 10M 1470queue mail parent std bandwidth 10M 1471queue http parent std bandwidth 80M default 1472.Ed 1473.Pp 1474The specified bandwidth is the target bandwidth, every queue can receive 1475more bandwidth as long as the parent still has some available. 1476The maximum bandwidth that should be assigned to a given queue can be limited 1477using the 1478.Cm max 1479keyword. 1480Similarly, a minimum (reserved) bandwidth can be specified. 1481.Bd -literal -offset indent 1482queue ssh parent std bandwidth 10M, min 5M, max 25M 1483.Ed 1484.Pp 1485For each of these 3 bandwidth specifications an additional burst bandwidth and 1486time can be specified. 1487.Bd -literal -offset indent 1488queue ssh parent std bandwidth 10M burst 90M for 100ms 1489.Ed 1490.Pp 1491All 1492.Cm bandwidth 1493values must be specified as an absolute value. 1494The suffixes 1495.Cm K , 1496.Cm M , 1497and 1498.Cm G 1499are used to represent bits, kilobits, megabits, and 1500gigabits per second, respectively. 1501The value must not exceed the interface bandwidth. 1502.Pp 1503In addition to the bandwidth specifications queues support the following 1504options: 1505.Bl -tag -width xxxx 1506.It Cm default 1507Packets not matched by another queue are assigned to this queue. 1508Exactly one default queue per interface is required. 1509.It Cm on Ar interface 1510Specifies the interface the queue operates on. 1511If not given, it operates on all matching interfaces. 1512.It Cm parent Ar name 1513Defines which parent queue the queue should be attached to. 1514Mandatory for all queues except root queues. 1515The parent queue must exist. 1516.It Cm qlimit Ar limit 1517The maximum number of packets held in the queue. 1518The default is 50. 1519.El 1520.Pp 1521Packets can be assigned to queues based on filter rules by using the 1522.Cm queue 1523keyword. 1524Normally only one 1525.Ar queue 1526is specified; when a second one is specified it will instead be used for 1527packets which have a TOS of 1528.Cm lowdelay 1529and for TCP ACKs with no data payload. 1530.Pp 1531To continue the previous example, the examples below would specify the 1532four referenced 1533queues, plus a few child queues. 1534Interactive 1535.Xr ssh 1 1536sessions get a queue with a minimum bandwidth; 1537.Xr scp 1 1538and 1539.Xr sftp 1 1540bulk transfers go to a separate queue. 1541The queues are then referenced by filtering rules (see 1542.Sx PACKET FILTERING , 1543above). 1544.Bd -literal -offset 4n 1545queue rootq on em0 bandwidth 100M max 100M 1546queue http parent rootq bandwidth 60M burst 90M for 100ms 1547queue developers parent http bandwidth 45M 1548queue employees parent http bandwidth 15M 1549queue mail parent rootq bandwidth 10M 1550queue ssh parent rootq bandwidth 20M 1551queue ssh_interactive parent ssh bandwidth 10M min 5M 1552queue ssh_bulk parent ssh bandwidth 10M 1553queue std parent rootq bandwidth 20M default 1554 1555block return out on em0 inet all set queue std 1556pass out on em0 inet proto tcp from $developerhosts to any port 80 \e 1557 set queue developers 1558pass out on em0 inet proto tcp from $employeehosts to any port 80 \e 1559 set queue employees 1560pass out on em0 inet proto tcp from any to any port 22 \e 1561 set queue(ssh_bulk, ssh_interactive) 1562pass out on em0 inet proto tcp from any to any port 25 \e 1563 set queue mail 1564.Ed 1565.Sh TABLES 1566Tables are named structures which can hold a collection of addresses and 1567networks. 1568Lookups against tables in 1569.Xr pf 4 1570are relatively fast, making a single rule with tables much more efficient, 1571in terms of 1572processor usage and memory consumption, than a large number of rules which 1573differ only in IP address (either created explicitly or automatically by rule 1574expansion). 1575.Pp 1576Tables can be used as the source or destination of filter 1577or translation rules. 1578They can also be used for the redirect address of 1579.Cm nat-to 1580and 1581.Cm rdr-to 1582and in the routing options of filter rules, but not for 1583.Cm bitmask 1584pools. 1585.Pp 1586Tables can be defined with any of the following 1587.Xr pfctl 8 1588mechanisms. 1589As with macros, reserved words may not be used as table names. 1590.Bl -tag -width "manually" 1591.It manually 1592Persistent tables can be manually created with the 1593.Cm add 1594or 1595.Cm replace 1596option of 1597.Xr pfctl 8 , 1598before or after the ruleset has been loaded. 1599.It Nm 1600Table definitions can be placed directly in this file and loaded at the 1601same time as other rules are loaded, atomically. 1602Table definitions inside 1603.Nm 1604use the 1605.Ic table 1606statement, and are especially useful to define non-persistent tables. 1607The contents of a pre-existing table defined without a list of addresses 1608to initialize it is not altered when 1609.Nm 1610is loaded. 1611A table initialized with the empty list, 1612.Li { } , 1613will be cleared on load. 1614.El 1615.Pp 1616Tables may be defined with the following attributes: 1617.Bl -tag -width counters 1618.It Cm const 1619The 1620.Cm const 1621flag prevents the user from altering the contents of the table once it 1622has been created. 1623Without that flag, 1624.Xr pfctl 8 1625can be used to add or remove addresses from the table at any time, even 1626when running with 1627.Xr securelevel 7 1628= 2. 1629.It Cm counters 1630The 1631.Cm counters 1632flag enables per-address packet and byte counters, which can be displayed with 1633.Xr pfctl 8 . 1634.It Cm persist 1635The 1636.Cm persist 1637flag forces the kernel to keep the table even when no rules refer to it. 1638If the flag is not set, the kernel will automatically remove the table 1639when the last rule referring to it is flushed. 1640.El 1641.Pp 1642This example creates a table called 1643.Dq private , 1644to hold RFC 1918 private network blocks, 1645and a table called 1646.Dq badhosts , 1647which is initially empty. 1648A filter rule is set up to block all traffic coming from addresses listed in 1649either table: 1650.Bd -literal -offset indent 1651table <private> const { 10/8, 172.16/12, 192.168/16 } 1652table <badhosts> persist 1653block on fxp0 from { <private>, <badhosts> } to any 1654.Ed 1655.Pp 1656The private table cannot have its contents changed and the badhosts table 1657will exist even when no active filter rules reference it. 1658Addresses may later be added to the badhosts table, so that traffic from 1659these hosts can be blocked by using the following: 1660.Pp 1661.Dl # pfctl -t badhosts -Tadd 204.92.77.111 1662.Pp 1663A table can also be initialized with an address list specified in one or more 1664external files, using the following syntax: 1665.Bd -literal -offset indent 1666table <spam> persist file "/etc/spammers" file "/etc/openrelays" 1667block on fxp0 from <spam> to any 1668.Ed 1669.Pp 1670The files 1671.Pa /etc/spammers 1672and 1673.Pa /etc/openrelays 1674list IP addresses, one per line. 1675Any lines beginning with a 1676.Sq # 1677are treated as comments and ignored. 1678In addition to being specified by IP address, hosts may also be 1679specified by their hostname. 1680When the resolver is called to add a hostname to a table, 1681.Em all 1682resulting IPv4 and IPv6 addresses are placed into the table. 1683IP addresses can also be entered in a table by specifying a valid interface 1684name, a valid interface group, or the 1685.Cm self 1686keyword, in which case all addresses assigned to the interface(s) will be 1687added to the table. 1688.Sh ANCHORS 1689Besides the main ruleset, 1690.Nm 1691can specify anchor attachment points. 1692An anchor is a container that can hold rules, 1693address tables, and other anchors. 1694When evaluation of the main ruleset reaches an 1695.Ic anchor 1696rule, 1697.Xr pf 4 1698will proceed to evaluate all rules specified in that anchor. 1699.Pp 1700The following example blocks all packets on the external interface by default, 1701then evaluates all rules in the anchor named "spam", 1702and finally passes all outgoing connections and 1703incoming connections to port 25: 1704.Bd -literal -offset indent 1705ext_if = "kue0" 1706block on $ext_if all 1707anchor spam 1708pass out on $ext_if all 1709pass in on $ext_if proto tcp from any to $ext_if port smtp 1710.Ed 1711.Pp 1712Anchors can be manipulated through 1713.Xr pfctl 8 1714without reloading the main ruleset or other anchors. 1715This loads a single rule into the anchor, 1716which blocks all packets from a specific address: 1717.Bd -literal -offset indent 1718# echo "block in quick from 1.2.3.4 to any" | pfctl -a spam -f - 1719.Ed 1720.Pp 1721The anchor can also be populated by adding a 1722.Ic load anchor 1723rule after the anchor rule. 1724When 1725.Xr pfctl 8 1726loads 1727.Nm , 1728it will also load all the rules from the file 1729.Pa /etc/pf-spam.conf 1730into the anchor. 1731.Bd -literal -offset indent 1732anchor spam 1733load anchor spam from "/etc/pf-spam.conf" 1734.Ed 1735.Pp 1736Filter rule anchors can also be loaded inline in the ruleset 1737within a brace-delimited block. 1738Brace delimited blocks may contain rules or other brace-delimited blocks. 1739When anchors are loaded this way the anchor name becomes optional. 1740Since the parser specification for anchor names is a string, 1741double quote characters 1742.Pq Sq \&" 1743should be placed around the anchor name. 1744.Bd -literal -offset indent 1745anchor "external" on egress { 1746 block 1747 anchor out { 1748 pass proto tcp from any to port { 25, 80, 443 } 1749 } 1750 pass in proto tcp to any port 22 1751} 1752.Ed 1753.Pp 1754Anchor rules can also specify packet filtering parameters 1755using the same syntax as filter rules. 1756When parameters are used, 1757the anchor rule is only evaluated for matching packets. 1758This allows conditional evaluation of anchors, like: 1759.Bd -literal -offset indent 1760block on $ext_if all 1761anchor spam proto tcp from any to any port smtp 1762pass out on $ext_if all 1763pass in on $ext_if proto tcp from any to $ext_if port smtp 1764.Ed 1765.Pp 1766The rules inside anchor "spam" are only evaluated 1767for TCP packets with destination port 25. 1768Hence, the following 1769will only block connections from 1.2.3.4 to port 25: 1770.Bd -literal -offset indent 1771# echo "block in quick from 1.2.3.4 to any" | pfctl -a spam -f - 1772.Ed 1773.Pp 1774Matching filter and translation rules marked with the 1775.Cm quick 1776option are final and abort the evaluation of the rules in other 1777anchors and the main ruleset. 1778If the anchor itself is marked with the 1779.Cm quick 1780option, 1781ruleset evaluation will terminate when the anchor is exited if the packet is 1782matched by any rule within the anchor. 1783.Pp 1784An anchor references other anchor attachment points 1785using the following syntax: 1786.Bl -tag -width xxxx 1787.It Ic anchor Ar name 1788Evaluates the filter rules in the specified anchor. 1789.El 1790.Pp 1791An anchor has a name which specifies the path where 1792.Xr pfctl 8 1793can be used to access the anchor to perform operations on it, such as 1794attaching child anchors to it or loading rules into it. 1795Anchors may be nested, with components separated by 1796.Sq / 1797characters, similar to how file system hierarchies are laid out. 1798The main ruleset is actually the default anchor, so filter and 1799translation rules, for example, may also be contained in any anchor. 1800.Pp 1801Anchor rules are evaluated relative to the anchor in which they are contained. 1802For example, 1803all anchor rules specified in the main ruleset will reference 1804anchor attachment points underneath the main ruleset, 1805and anchor rules specified in a file loaded from a 1806.Ic load anchor 1807rule will be attached under that anchor point. 1808.Pp 1809Anchors may end with the asterisk 1810.Pq Sq * 1811character, which signifies that all anchors attached at that point 1812should be evaluated in the alphabetical ordering of their anchor name. 1813For example, 1814the following 1815will evaluate each rule in each anchor attached to the "spam" anchor: 1816.Bd -literal -offset indent 1817anchor "spam/*" 1818.Ed 1819.Pp 1820Note that it will only evaluate anchors that are directly attached to the 1821"spam" anchor, and will not descend to evaluate anchors recursively. 1822.Pp 1823Since anchors are evaluated relative to the anchor in which they are 1824contained, there is a mechanism for accessing the parent and ancestor 1825anchors of a given anchor. 1826Similar to file system path name resolution, if the sequence 1827.Sq .. 1828appears as an anchor path component, the parent anchor of the current 1829anchor in the path evaluation at that point will become the new current 1830anchor. 1831As an example, consider the following: 1832.Bd -literal -offset indent 1833# printf 'anchor "spam/allowed"\en' | pfctl -f - 1834# printf 'anchor "../banned"\enpass\en' | pfctl -a spam/allowed -f - 1835.Ed 1836.Pp 1837Evaluation of the main ruleset will lead into the 1838spam/allowed anchor, which will evaluate the rules in the 1839spam/banned anchor, if any, before finally evaluating the 1840.Ic pass 1841rule. 1842.Sh STATEFUL FILTERING 1843.Xr pf 4 1844filters packets statefully, 1845which has several advantages. 1846For TCP connections, comparing a packet to a state involves checking 1847its sequence numbers, as well as TCP timestamps if a rule using the 1848.Cm reassemble tcp 1849parameter applies to the connection. 1850If these values are outside the narrow windows of expected 1851values, the packet is dropped. 1852This prevents spoofing attacks, such as when an attacker sends packets with 1853a fake source address/port but does not know the connection's sequence 1854numbers. 1855Similarly, 1856.Xr pf 4 1857knows how to match ICMP replies to states. 1858For example, 1859to allow echo requests (such as those created by 1860.Xr ping 8 ) 1861out statefully and match incoming echo replies correctly to states: 1862.Pp 1863.Dl pass out inet proto icmp all icmp-type echoreq 1864.Pp 1865Also, looking up states is usually faster than evaluating rules. 1866If there are 50 rules, all of them are evaluated sequentially in O(n). 1867Even with 50000 states, only 16 comparisons are needed to match a 1868state, since states are stored in a binary search tree that allows 1869searches in O(log2\~n). 1870.Pp 1871Furthermore, correct handling of ICMP error messages is critical to 1872many protocols, particularly TCP. 1873.Xr pf 4 1874matches ICMP error messages to the correct connection, checks them against 1875connection parameters, and passes them if appropriate. 1876For example if an ICMP source quench message referring to a stateful TCP 1877connection arrives, it will be matched to the state and get passed. 1878.Pp 1879Finally, state tracking is required for 1880.Cm nat-to 1881and 1882.Cm rdr-to 1883options, in order to track address and port translations and reverse the 1884translation on returning packets. 1885.Pp 1886.Xr pf 4 1887will also create state for other protocols which are effectively stateless by 1888nature. 1889UDP packets are matched to states using only host addresses and ports, 1890and other protocols are matched to states using only the host addresses. 1891.Pp 1892If stateless filtering of individual packets is desired, 1893the 1894.Cm no state 1895keyword can be used to specify that state will not be created 1896if this is the last matching rule. 1897Note that packets which match neither block nor pass rules, 1898and thus are passed by default, 1899are effectively passed as if 1900.Cm no state 1901had been specified. 1902.Pp 1903A number of parameters can also be set to affect how 1904.Xr pf 4 1905handles state tracking, 1906as detailed below. 1907.Ss State Modulation 1908Much of the security derived from TCP is attributable to how well the 1909initial sequence numbers (ISNs) are chosen. 1910Some popular stack implementations choose 1911.Em very 1912poor ISNs and thus are normally susceptible to ISN prediction exploits. 1913By applying a 1914.Cm modulate state 1915rule to a TCP connection, 1916.Xr pf 4 1917will create a high quality random sequence number for each connection 1918endpoint. 1919.Pp 1920The 1921.Cm modulate state 1922directive implicitly keeps state on the rule and is 1923only applicable to TCP connections. 1924.Pp 1925For instance: 1926.Bd -literal -offset indent 1927block all 1928pass out proto tcp from any to any modulate state 1929pass in proto tcp from any to any port 25 flags S/SFRA \e 1930 modulate state 1931.Ed 1932.Pp 1933Note that modulated connections will not recover when the state table 1934is lost (firewall reboot, flushing the state table, etc.). 1935.Xr pf 4 1936will not be able to infer a connection again after the state table flushes 1937the connection's modulator. 1938When the state is lost, the connection may be left dangling until the 1939respective endpoints time out the connection. 1940It is possible on a fast local network for the endpoints to start an ACK 1941storm while trying to resynchronize after the loss of the modulator. 1942The default 1943.Cm flags 1944settings (or a more strict equivalent) should be used on 1945.Cm modulate state 1946rules to prevent ACK storms. 1947.Pp 1948Note that alternative methods are available 1949to prevent loss of the state table 1950and allow for firewall failover. 1951See 1952.Xr carp 4 1953and 1954.Xr pfsync 4 1955for further information. 1956.Ss SYN Proxy 1957By default, 1958.Xr pf 4 1959passes packets that are part of a 1960TCP handshake between the endpoints. 1961The 1962.Cm synproxy state 1963option can be used to cause 1964.Xr pf 4 1965itself to complete the handshake with the active endpoint, perform a handshake 1966with the passive endpoint, and then forward packets between the endpoints. 1967.Pp 1968No packets are sent to the passive endpoint before the active endpoint has 1969completed the handshake, hence so-called SYN floods with spoofed source 1970addresses will not reach the passive endpoint, as the sender can't complete the 1971handshake. 1972.Pp 1973The proxy is transparent to both endpoints; they each see a single 1974connection from/to the other endpoint. 1975.Xr pf 4 1976chooses random initial sequence numbers for both handshakes. 1977Once the handshakes are completed, the sequence number modulators 1978(see previous section) are used to translate further packets of the 1979connection. 1980.Cm synproxy state 1981includes 1982.Cm modulate state . 1983.Pp 1984Rules with 1985.Cm synproxy state 1986will not work if 1987.Xr pf 4 1988operates on a 1989.Xr bridge 4 . 1990.Pp 1991Example: 1992.Bd -literal -offset indent 1993pass in proto tcp from any to any port www synproxy state 1994.Ed 1995.Ss Stateful Tracking Options 1996A number of options related to stateful tracking can be applied on a 1997per-rule basis. 1998One of 1999.Cm keep state , 2000.Cm modulate state , 2001or 2002.Cm synproxy state 2003must be specified explicitly to apply these options to a rule. 2004.Pp 2005.Bl -tag -width xxxx -compact 2006.It Cm floating 2007States can match packets on any interfaces 2008(the opposite of 2009.Cm if-bound ) . 2010This is the default. 2011.It Cm if-bound 2012States are bound to an interface 2013(the opposite of 2014.Cm floating ) . 2015.It Cm max Ar number 2016Limits the number of concurrent states the rule may create. 2017When this limit is reached, further packets that would create 2018state are dropped until existing states time out. 2019.It Cm no-sync 2020Prevent state changes for states created by this rule from appearing on the 2021.Xr pfsync 4 2022interface. 2023.It Cm pflow 2024States created by this rule are exported on the 2025.Xr pflow 4 2026interface. 2027.It Cm sloppy 2028Uses a sloppy TCP connection tracker that does not check sequence 2029numbers at all, which makes insertion and ICMP teardown attacks way 2030easier. 2031This is intended to be used in situations where one does not see all 2032packets of a connection, e.g. in asymmetric routing situations. 2033It cannot be used with 2034.Cm modulate state 2035or 2036.Cm synproxy state . 2037.It Ar timeout seconds 2038Changes the 2039.Ar timeout 2040values used for states created by this rule. 2041For a list of all valid 2042.Ar timeout 2043names, see 2044.Sx OPTIONS 2045above. 2046.El 2047.Pp 2048Multiple options can be specified, separated by commas: 2049.Bd -literal -offset indent 2050pass in proto tcp from any to any \e 2051 port www keep state \e 2052 (max 100, source-track rule, max-src-nodes 75, \e 2053 max-src-states 3, tcp.established 60, tcp.closing 5) 2054.Ed 2055.Pp 2056When the 2057.Cm source-track 2058keyword is specified, the number of states per source IP is tracked. 2059.Pp 2060.Bl -tag -width xxxx -compact 2061.It Cm source-track global 2062The number of states created by all rules that use this option is limited. 2063Each rule can specify different 2064.Cm max-src-nodes 2065and 2066.Cm max-src-states 2067options, however state entries created by any participating rule count towards 2068each individual rule's limits. 2069.It Cm source-track rule 2070The maximum number of states created by this rule is limited by the rule's 2071.Cm max-src-nodes 2072and 2073.Cm max-src-states 2074options. 2075Only state entries created by this particular rule count toward the rule's 2076limits. 2077.El 2078.Pp 2079The following limits can be set: 2080.Pp 2081.Bl -tag -width xxxx -compact 2082.It Cm max-src-nodes Ar number 2083Limits the maximum number of source addresses which can simultaneously 2084have state table entries. 2085.It Cm max-src-states Ar number 2086Limits the maximum number of simultaneous state entries that a single 2087source address can create with this rule. 2088.El 2089.Pp 2090For stateful TCP connections, limits on established connections (connections 2091which have completed the TCP 3-way handshake) can also be enforced 2092per source IP. 2093.Pp 2094.Bl -tag -width xxxx -compact 2095.It Cm max-src-conn Ar number 2096Limits the maximum number of simultaneous TCP connections which have 2097completed the 3-way handshake that a single host can make. 2098.It Cm max-src-conn-rate Ar number Ns / Ns Ar seconds 2099Limit the rate of new connections over a time interval. 2100The connection rate is an approximation calculated as a moving average. 2101.El 2102.Pp 2103When one of these limits is reached, further packets that would create 2104state are dropped until existing states time out. 2105.Pp 2106Because the 3-way handshake ensures that the source address is not being 2107spoofed, more aggressive action can be taken based on these limits. 2108With the 2109.Cm overload Pf < Ar table Ns > 2110state option, source IP addresses which hit either of the limits on 2111established connections will be added to the named 2112.Ar table . 2113This table can be used in the ruleset to block further activity from 2114the offending host, redirect it to a tarpit process, or restrict its 2115bandwidth. 2116.Pp 2117The optional 2118.Cm flush 2119keyword kills all states created by the matching rule which originate 2120from the host which exceeds these limits. 2121The 2122.Cm global 2123modifier to the 2124.Cm flush 2125command kills all states originating from the 2126offending host, regardless of which rule created the state. 2127.Pp 2128For example, the following rules will protect the webserver against 2129hosts making more than 100 connections in 10 seconds. 2130Any host which connects faster than this rate will have its address added 2131to the <bad_hosts> table and have all states originating from it flushed. 2132Any new packets arriving from this host will be dropped unconditionally 2133by the block rule. 2134.Bd -literal -offset indent 2135block quick from <bad_hosts> 2136pass in on $ext_if proto tcp to $webserver port www keep state \e 2137 (max-src-conn-rate 100/10, overload <bad_hosts> flush global) 2138.Ed 2139.Sh TRAFFIC NORMALISATION 2140Traffic normalisation is a broad umbrella term 2141for aspects of the packet filter which deal with 2142verifying packets, packet fragments, spoof traffic, 2143and other irregularities. 2144.Ss Scrub 2145Scrub involves sanitising packet content in such a way 2146that there are no ambiguities in packet interpretation on the receiving side. 2147It is invoked with the 2148.Cm scrub 2149option, added to regular rules. 2150.Pp 2151Parameters are specified enclosed in parentheses. 2152At least one of the following parameters must be specified: 2153.Bl -tag -width xxxx 2154.It Cm max-mss Ar number 2155Enforces a maximum segment size (MSS) for matching TCP packets. 2156.It Cm min-ttl Ar number 2157Enforces a minimum TTL for matching IP packets. 2158.It Cm no-df 2159Clears the 2160.Dq dont-fragment 2161bit from a matching IPv4 packet. 2162Some operating systems have NFS implementations 2163which are known to generate fragmented packets with the 2164.Dq dont-fragment 2165bit set. 2166.Xr pf 4 2167will drop such fragmented 2168.Dq dont-fragment 2169packets unless 2170.Cm no-df 2171is specified. 2172.Pp 2173Unfortunately some operating systems also generate their 2174.Dq dont-fragment 2175packets with a zero IP identification field. 2176Clearing the 2177.Dq dont-fragment 2178bit on packets with a zero IP ID may cause deleterious results if an 2179upstream router later fragments the packet. 2180Using 2181.Cm random-id 2182is recommended in combination with 2183.Cm no-df 2184to ensure unique IP identifiers. 2185.It Cm random-id 2186Replaces the IPv4 identification field with random values to compensate 2187for predictable values generated by many hosts. 2188This option only applies to packets that are not fragmented 2189after the optional fragment reassembly. 2190.It Cm reassemble tcp 2191Statefully normalises TCP connections. 2192.Cm reassemble tcp 2193performs the following normalisations: 2194.Bl -ohang 2195.It TTL 2196Neither side of the connection is allowed to reduce their IP TTL. 2197An attacker may send a packet such that it reaches the firewall, affects 2198the firewall state, and expires before reaching the destination host. 2199.Cm reassemble tcp 2200will raise the TTL of all packets back up to the highest value seen on 2201the connection. 2202.It Timestamp Modulation 2203Modern TCP stacks will send a timestamp on every TCP packet and echo 2204the other endpoint's timestamp back to them. 2205Many operating systems will merely start the timestamp at zero when 2206first booted, and increment it several times a second. 2207The uptime of the host can be deduced by reading the timestamp and multiplying 2208by a constant. 2209Also observing several different timestamps can be used to count hosts 2210behind a NAT device. 2211And spoofing TCP packets into a connection requires knowing or guessing 2212valid timestamps. 2213Timestamps merely need to be monotonically increasing and not derived off a 2214guessable base time. 2215.Cm reassemble tcp 2216will cause 2217.Cm scrub 2218to modulate the TCP timestamps with a random number. 2219.It Extended PAWS Checks 2220There is a problem with TCP on long fat pipes, in that a packet might get 2221delayed for longer than it takes the connection to wrap its 32-bit sequence 2222space. 2223In such an occurrence, the old packet would be indistinguishable from a 2224new packet and would be accepted as such. 2225The solution to this is called PAWS: Protection Against Wrapped Sequence 2226numbers. 2227It protects against it by making sure the timestamp on each packet does 2228not go backwards. 2229.Cm reassemble tcp 2230also makes sure the timestamp on the packet does not go forward more 2231than the RFC allows. 2232By doing this, 2233.Xr pf 4 2234artificially extends the security of TCP sequence numbers by 10 to 18 2235bits when the host uses appropriately randomized timestamps, since a 2236blind attacker would have to guess the timestamp as well. 2237.El 2238.El 2239.Pp 2240For example: 2241.Pp 2242.Dl match in all scrub (no-df random-id max-mss 1440) 2243.Ss Fragment Handling 2244The size of IP datagrams (packets) can be significantly larger than the 2245maximum transmission unit (MTU) of the network. 2246In cases when it is necessary or more efficient to send such large packets, 2247the large packet will be fragmented into many smaller packets that will each 2248fit onto the wire. 2249Unfortunately for a firewalling device, only the first logical fragment will 2250contain the necessary header information for the subprotocol that allows 2251.Xr pf 4 2252to filter on things such as TCP ports or to perform NAT. 2253.Pp 2254One alternative is to filter individual fragments with filter rules. 2255If packet reassembly is turned off, it is passed to the filter. 2256Filter rules with matching IP header parameters decide whether the 2257fragment is passed or blocked, in the same way as complete packets 2258are filtered. 2259Without reassembly, fragments can only be filtered based on IP header 2260fields (source/destination address, protocol), since subprotocol header 2261fields are not available (TCP/UDP port numbers, ICMP code/type). 2262The 2263.Cm fragment 2264option can be used to restrict filter rules to apply only to 2265fragments, but not complete packets. 2266Filter rules without the 2267.Cm fragment 2268option still apply to fragments, if they only specify IP header fields. 2269For instance: 2270.Bd -literal -offset indent 2271pass in proto tcp from any to any port 80 2272.Ed 2273.Pp 2274The rule above never applies to a fragment, 2275even if the fragment is part of a TCP packet with destination port 80, 2276because without reassembly this information 2277is not available for each fragment. 2278This also means that fragments cannot create new or match existing 2279state table entries, which makes stateful filtering and address 2280translation (NAT, redirection) for fragments impossible. 2281.Pp 2282In most cases, the benefits of reassembly outweigh the additional 2283memory cost, 2284so reassembly is on by default. 2285.Pp 2286The memory allocated for fragment caching can be limited using 2287.Xr pfctl 8 . 2288Once this limit is reached, fragments that would have to be cached 2289are dropped until other entries time out. 2290The timeout value can also be adjusted. 2291.Pp 2292When forwarding reassembled IPv6 packets, pf refragments them with 2293the original maximum fragment size. 2294This allows the sender to determine the optimal fragment size by 2295path MTU discovery. 2296.Ss Blocking Spoofed Traffic 2297Spoofing is the faking of IP addresses, 2298typically for malicious purposes. 2299The 2300.Ic antispoof 2301directive expands to a set of filter rules which will block all 2302traffic with a source IP from the network(s) directly connected 2303to the specified interface(s) from entering the system through 2304any other interface. 2305.Pp 2306For example: 2307.Dl antispoof for lo0 2308.Pp 2309Expands to: 2310.Bd -literal -offset indent -compact 2311block drop in on ! lo0 inet from 127.0.0.1/8 to any 2312block drop in on ! lo0 inet6 from ::1 to any 2313.Ed 2314.Pp 2315For non-loopback interfaces, there are additional rules to block incoming 2316packets with a source IP address identical to the interface's IP(s). 2317For example, assuming the interface wi0 had an IP address of 10.0.0.1 and a 2318netmask of 255.255.255.0: 2319.Pp 2320.Dl antispoof for wi0 inet 2321.Pp 2322Expands to: 2323.Bd -literal -offset indent -compact 2324block drop in on ! wi0 inet from 10.0.0.0/24 to any 2325block drop in inet from 10.0.0.1 to any 2326.Ed 2327.Pp 2328Caveat: Rules created by the 2329.Ic antispoof 2330directive interfere with packets sent over loopback interfaces 2331to local addresses. 2332One should pass these explicitly. 2333.Sh OPERATING SYSTEM FINGERPRINTING 2334Passive OS fingerprinting is a mechanism to inspect nuances of a TCP 2335connection's initial SYN packet and guess at the host's operating system. 2336Unfortunately these nuances are easily spoofed by an attacker so the 2337fingerprint is not useful in making security decisions. 2338But the fingerprint is typically accurate enough to make policy decisions 2339upon. 2340.Pp 2341The fingerprints may be specified by operating system class, by 2342version, or by subtype/patchlevel. 2343The class of an operating system is typically the vendor or genre 2344and would be 2345.Ox 2346for the 2347.Xr pf 4 2348firewall itself. 2349The version of the oldest available 2350.Ox 2351release on the main FTP site 2352would be 2.6 and the fingerprint would be written as: 2353.Pp 2354.Dl \&"OpenBSD 2.6\&" 2355.Pp 2356The subtype of an operating system is typically used to describe the 2357patchlevel if that patch led to changes in the TCP stack behavior. 2358In the case of 2359.Ox , 2360the only subtype is for a fingerprint that was 2361normalised by the 2362.Cm no-df 2363scrub option and would be specified as: 2364.Pp 2365.Dl \&"OpenBSD 3.3 no-df\&" 2366.Pp 2367Fingerprints for most popular operating systems are provided by 2368.Xr pf.os 5 . 2369Once 2370.Xr pf 4 2371is running, a complete list of known operating system fingerprints may 2372be listed by running: 2373.Pp 2374.Dl # pfctl -so 2375.Pp 2376Filter rules can enforce policy at any level of operating system specification 2377assuming a fingerprint is present. 2378Policy could limit traffic to approved operating systems or even ban traffic 2379from hosts that aren't at the latest service pack. 2380.Pp 2381The 2382.Cm unknown 2383class can also be used as the fingerprint which will match packets for 2384which no operating system fingerprint is known. 2385.Pp 2386Examples: 2387.Bd -literal -offset indent 2388pass out proto tcp from any os OpenBSD 2389block out proto tcp from any os Doors 2390block out proto tcp from any os "Doors PT" 2391block out proto tcp from any os "Doors PT SP3" 2392block out from any os "unknown" 2393pass on lo0 proto tcp from any os "OpenBSD 3.3 lo0" 2394.Ed 2395.Pp 2396Operating system fingerprinting is limited only to the TCP SYN packet. 2397This means that it will not work on other protocols and will not match 2398a currently established connection. 2399.Pp 2400Caveat: operating system fingerprints are occasionally wrong. 2401There are three problems: an attacker can trivially craft his packets to 2402appear as any operating system he chooses; 2403an operating system patch could change the stack behavior and no fingerprints 2404will match it until the database is updated; 2405and multiple operating systems may have the same fingerprint. 2406.Sh EXAMPLES 2407In this example, 2408the external interface is 2409.Pa kue0 . 2410We use a macro for the interface name, so it can be changed easily. 2411All incoming traffic is "normalised", 2412and everything is blocked and logged by default. 2413.Bd -literal -offset 4n 2414ext_if = "kue0" 2415match in all scrub (no-df max-mss 1440) 2416block return log on $ext_if all 2417.Ed 2418.Pp 2419Here we specifically block packets we don't want: 2420anything coming from source we have no back routes for; 2421packets whose ingress interface does not match the one in 2422the route back to their source address; 2423anything that does not have our address (157.161.48.183) as source; 2424broadcasts (cable modem noise); 2425and anything from reserved address space or invalid addresses. 2426.Bd -literal -offset 4n 2427block in from no-route to any 2428block in from urpf-failed to any 2429block out log quick on $ext_if from ! 157.161.48.183 to any 2430block in quick on $ext_if from any to 255.255.255.255 2431block in log quick on $ext_if from { 10.0.0.0/8, 172.16.0.0/12, \e 2432 192.168.0.0/16, 255.255.255.255/32 } to any 2433.Ed 2434.Pp 2435For ICMP, 2436pass out/in ping queries. 2437State matching is done on host addresses and ICMP ID (not type/code), 2438so replies (like 0/0 for 8/0) will match queries. 2439ICMP error messages (which always refer to a TCP/UDP packet) 2440are handled by the TCP/UDP states. 2441.Bd -literal -offset 4n 2442pass on $ext_if inet proto icmp all icmp-type 8 code 0 2443.Ed 2444.Pp 2445For UDP, 2446pass out all UDP connections. 2447DNS connections are passed in. 2448.Bd -literal -offset 4n 2449pass out on $ext_if proto udp all 2450pass in on $ext_if proto udp from any to any port domain 2451.Ed 2452.Pp 2453For TCP, 2454pass out all TCP connections and modulate state. 2455SSH, SMTP, DNS, and IDENT connections are passed in. 2456We do not allow Windows 9x SMTP connections since they are typically 2457a viral worm. 2458.Bd -literal -offset 4n 2459pass out on $ext_if proto tcp all modulate state 2460pass in on $ext_if proto tcp from any to any \e 2461 port { ssh, smtp, domain, auth } 2462block in on $ext_if proto tcp from any \e 2463 os { "Windows 95", "Windows 98" } to any port smtp 2464.Ed 2465.Pp 2466Here we pass in/out all IPv6 traffic: 2467note that we have to enable this in two different ways, 2468on both our physical interface and our tunnel. 2469.Bd -literal -offset 4n 2470pass quick on gif0 inet6 2471pass quick on $ext_if proto ipv6 2472.Ed 2473.Pp 2474This example illustrates packet tagging. 2475There are three interfaces: $int_if, $ext_if, and $wifi_if (wireless). 2476NAT is being done on $ext_if for all outgoing packets. 2477Packets in on $int_if are tagged and passed out on $ext_if. 2478All other outgoing packets 2479(i.e. packets from the wireless network) 2480are only permitted to access port 80. 2481.Bd -literal -offset 4n 2482pass in on $int_if from any to any tag INTNET 2483pass in on $wifi_if from any to any 2484 2485block out on $ext_if from any to any 2486pass out quick on $ext_if tagged INTNET 2487pass out on $ext_if proto tcp from any to any port 80 2488.Ed 2489.Pp 2490In this example, 2491we tag incoming packets as they are redirected to spamd(8). 2492The tag is used to pass those packets through the packet filter. 2493.Bd -literal -offset 4n 2494match in on $ext_if inet proto tcp from <spammers> to port smtp \e 2495 tag SPAMD rdr-to 127.0.0.1 port spamd 2496 2497block in on $ext_if 2498pass in on $ext_if inet proto tcp tagged SPAMD 2499.Ed 2500.Pp 2501This example maps incoming requests on port 80 to port 8080, on 2502which a daemon is running (because, for example, it is not run as root, 2503and therefore lacks permission to bind to port 80). 2504.Bd -literal -offset 4n 2505match in on $ext_if proto tcp from any to any port 80 \e 2506 rdr-to 127.0.0.1 port 8080 2507.Ed 2508.Pp 2509If a 2510.Ic pass 2511rule is used with the 2512.Cm quick 2513modifier, packets matching the translation rule are passed without 2514inspecting subsequent filter rules. 2515.Bd -literal -offset 4n 2516pass in quick on $ext_if proto tcp from any to any port 80 \e 2517 rdr-to 127.0.0.1 port 8080 2518.Ed 2519.Pp 2520In the example below, vlan12 is configured as 192.168.168.1; 2521the machine translates all packets coming from 192.168.168.0/24 to 204.92.77.111 2522when they are going out any interface except vlan12. 2523This has the net effect of making traffic from the 192.168.168.0/24 2524network appear as though it is the Internet routable address 2525204.92.77.111 to nodes behind any interface on the router except 2526for the nodes on vlan12. 2527Thus, 192.168.168.1 can talk to the 192.168.168.0/24 nodes. 2528.Bd -literal -offset 4n 2529match out on ! vlan12 from 192.168.168.0/24 to any nat-to 204.92.77.111 2530.Ed 2531.Pp 2532In the example below, the machine sits between a fake internal 2533144.19.74.* network, and a routable external IP of 204.92.77.100. 2534The last rule excludes protocol AH from being translated. 2535.Bd -literal -offset 4n 2536pass out on $ext_if from 144.19.74.0/24 nat-to 204.92.77.100 2537pass out on $ext_if proto ah from 144.19.74.0/24 2538.Ed 2539.Pp 2540In the example below, packets bound for one specific server, as well as those 2541generated by the sysadmins are not proxied; all other connections are. 2542.Bd -literal -offset 4n 2543pass in on $int_if proto { tcp, udp } from any to any port 80 \e 2544 rdr-to 127.0.0.1 port 80 2545pass in on $int_if proto { tcp, udp } from any to $server port 80 2546pass in on $int_if proto { tcp, udp } from $sysadmins to any port 80 2547.Ed 2548.Pp 2549This example maps outgoing packets' source port 2550to an assigned proxy port instead of an arbitrary port. 2551In this case, proxy outgoing isakmp with port 500 on the gateway. 2552.Bd -literal -offset 4n 2553match out on $ext_if inet proto udp from any port isakmp to any \e 2554 nat-to ($ext_if) port 500 2555.Ed 2556.Pp 2557One more example uses 2558.Cm rdr-to 2559to redirect a TCP and UDP port to an internal machine. 2560.Bd -literal -offset 4n 2561match in on $ext_if inet proto tcp from any to ($ext_if) port 8080 \e 2562 rdr-to 10.1.2.151 port 22 2563match in on $ext_if inet proto udp from any to ($ext_if) port 8080 \e 2564 rdr-to 10.1.2.151 port 53 2565.Ed 2566.Pp 2567In this example, a NAT gateway is set up to translate internal addresses 2568using a pool of public addresses (192.0.2.16/28). 2569A given source address is always translated to the same pool address by 2570using the 2571.Cm source-hash 2572keyword. 2573The gateway also translates incoming web server connections 2574to a group of web servers on the internal network. 2575.Bd -literal -offset 4n 2576match out on $ext_if inet from any to any nat-to 192.0.2.16/28 \e 2577 source-hash 2578match in on $ext_if proto tcp from any to any port 80 \e 2579 rdr-to { 10.1.2.155 weight 2, 10.1.2.160 weight 1, \e 2580 10.1.2.161 weight 8 } round-robin 2581.Ed 2582.Pp 2583The bidirectional address translation example uses a single 2584.Cm binat-to 2585rule that expands to a 2586.Cm nat-to 2587and an 2588.Cm rdr-to 2589rule. 2590.Bd -literal -offset 4n 2591pass on $ext_if from 10.1.2.120 to any binat-to 192.0.2.17 2592.Ed 2593.Pp 2594The previous example is identical to the following set of rules: 2595.Bd -literal -offset 4n 2596pass out on $ext_if inet from 10.1.2.120 to any \e 2597 nat-to 192.0.2.17 static-port 2598pass in on $ext_if inet from any to 192.0.2.17 rdr-to 10.1.2.120 2599.Ed 2600.Pp 2601In the example below, a router handling both address families 2602translates an internal IPv4 subnet to IPv6 using the well-known 260364:ff9b::/96 prefix: 2604.Bd -literal -offset 4n 2605pass in on $v4_if inet af-to inet6 from ($v6_if) to 64:ff9b::/96 2606.Ed 2607.Pp 2608Paired with the example above, the example below can be used on 2609another router handling both address families to translate back 2610to IPv4: 2611.Bd -literal -offset 4n 2612pass in on $v6_if inet6 to 64:ff9b::/96 af-to inet from ($v4_if) 2613.Ed 2614.Sh GRAMMAR 2615Syntax for 2616.Nm 2617in BNF: 2618.Bd -literal 2619line = ( option | pf-rule | 2620 antispoof-rule | queue-rule | anchor-rule | 2621 anchor-close | load-anchor | table-rule | include ) 2622 2623option = "set" ( [ "timeout" ( timeout | "{" timeout-list "}" ) ] | 2624 [ "ruleset-optimization" [ "none" | "basic" | 2625 "profile" ] ] | 2626 [ "optimization" [ "default" | "normal" | "high-latency" | 2627 "satellite" | "aggressive" | "conservative" ] ] 2628 [ "limit" ( limit-item | "{" limit-list "}" ) ] | 2629 [ "loginterface" ( interface-name | "none" ) ] | 2630 [ "block-policy" ( "drop" | "return" ) ] | 2631 [ "state-policy" ( "if-bound" | "floating" ) ] 2632 [ "state-defaults" state-opts ] 2633 [ "fingerprints" filename ] | 2634 [ "skip on" ifspec ] | 2635 [ "debug" ( "emerg" | "alert" | "crit" | "err" | 2636 "warning" | "notice" | "info" | "debug" ) ] | 2637 [ "reassemble" ( "yes" | "no" ) [ "no-df" ] ] ) 2638 2639pf-rule = action [ ( "in" | "out" ) ] 2640 [ "log" [ "(" logopts ")"] ] [ "quick" ] 2641 [ "on" ( ifspec | "rdomain" number ) ] [ af ] 2642 [ protospec ] hosts [ filteropts ] 2643 2644logopts = logopt [ [ "," ] logopts ] 2645logopt = "all" | "matches" | "user" | "to" interface-name 2646 2647filteropts = filteropt [ [ "," ] filteropts ] 2648filteropt = user | group | flags | icmp-type | icmp6-type | 2649 "tos" tos | 2650 ( "no" | "keep" | "modulate" | "synproxy" ) "state" 2651 [ "(" state-opts ")" ] | "scrub" "(" scrubopts ")" | 2652 "fragment" | "allow-opts" | "once" | 2653 "divert-packet" "port" port | "divert-reply" | 2654 "divert-to" host "port" port | 2655 "label" string | "tag" string | [ ! ] "tagged" string | 2656 "set prio" ( number | "(" number [ [ "," ] number ] ")" ) | 2657 "set queue" ( string | "(" string [ [ "," ] string ] ")" ) | 2658 "rtable" number | "probability" number"%" | "prio" number | 2659 "af-to" af "from" ( redirhost | "{" redirhost-list "}" ) 2660 [ "to" ( redirhost | "{" redirhost-list "}" ) ] | 2661 "binat-to" ( redirhost | "{" redirhost-list "}" ) 2662 [ portspec ] [ pooltype ] | 2663 "rdr-to" ( redirhost | "{" redirhost-list "}" ) 2664 [ portspec ] [ pooltype ] | 2665 "nat-to" ( redirhost | "{" redirhost-list "}" ) 2666 [ portspec ] [ pooltype ] [ "static-port" ] | 2667 [ route ] | [ "set tos" tos ] | 2668 [ [ "!" ] "received-on" ( interface-name | interface-group ) ] 2669 2670scrubopts = scrubopt [ [ "," ] scrubopts ] 2671scrubopt = "no-df" | "min-ttl" number | "max-mss" number | 2672 "reassemble tcp" | "random-id" 2673 2674antispoof-rule = "antispoof" [ "log" ] [ "quick" ] 2675 "for" ifspec [ af ] [ "label" string ] 2676 2677table-rule = "table" "<" string ">" [ tableopts ] 2678tableopts = tableopt [ tableopts ] 2679tableopt = "persist" | "const" | "counters" | 2680 "file" string | "{" [ tableaddrs ] "}" 2681tableaddrs = tableaddr-spec [ [ "," ] tableaddrs ] 2682tableaddr-spec = [ "!" ] tableaddr [ "/" mask-bits ] 2683tableaddr = hostname | ifspec | "self" | 2684 ipv4-dotted-quad | ipv6-coloned-hex 2685 2686queue-rule = "queue" string [ "on" interface-name ] queueopts-list 2687 2688anchor-rule = "anchor" [ string ] [ ( "in" | "out" ) ] [ "on" ifspec ] 2689 [ af ] [ protospec ] [ hosts ] [ filteropt-list ] [ "{" ] 2690 2691anchor-close = "}" 2692 2693load-anchor = "load anchor" string "from" filename 2694 2695queueopts-list = queueopts-list queueopts | queueopts 2696queueopts = [ "bandwidth" bandwidth ] | [ "min" bandwidth ] | 2697 [ "max" bandwidth ] | [ "parent" string ] | 2698 [ "default" ] | [ "qlimit" number ] 2699bandwidth = bandwidth-spec [ "burst" bandwidth-spec "for" number "ms" ] 2700bandwidth-spec = number ( "" | "K" | "M" | "G" ) 2701 2702action = "pass" | "match" | "block" [ return ] 2703return = "drop" | "return" | 2704 "return-rst" [ "(" "ttl" number ")" ] | 2705 "return-icmp" [ "(" icmpcode [ [ "," ] icmp6code ] ")" ] | 2706 "return-icmp6" [ "(" icmp6code ")" ] 2707icmpcode = ( icmp-code-name | icmp-code-number ) 2708icmp6code = ( icmp6-code-name | icmp6-code-number ) 2709 2710ifspec = ( [ "!" ] ( interface-name | interface-group ) ) | 2711 "{" interface-list "}" 2712interface-list = [ "!" ] ( interface-name | interface-group ) 2713 [ [ "," ] interface-list ] 2714route = ( "route-to" | "reply-to" | "dup-to" ) 2715 ( routehost | "{" routehost-list "}" ) 2716 [ pooltype ] 2717af = "inet" | "inet6" 2718 2719protospec = "proto" ( proto-name | proto-number | 2720 "{" proto-list "}" ) 2721proto-list = ( proto-name | proto-number ) [ [ "," ] proto-list ] 2722 2723hosts = "all" | 2724 "from" ( "any" | "no-route" | "urpf-failed" | "self" | 2725 host | "{" host-list "}" | "route" string ) [ port ] 2726 [ os ] 2727 "to" ( "any" | "no-route" | "self" | host | 2728 "{" host-list "}" | "route" string ) [ port ] 2729 2730ipspec = "any" | host | "{" host-list "}" 2731host = [ "!" ] ( address [ "weight" number ] | 2732 address [ "/" mask-bits ] [ "weight" number ] | 2733 "<" string ">" ) 2734redirhost = address [ "/" mask-bits ] 2735routehost = host | host "@" interface-name | 2736 "(" interface-name [ address [ "/" mask-bits ] ] ")" 2737address = ( interface-name | interface-group | 2738 "(" ( interface-name | interface-group ) ")" | 2739 hostname | ipv4-dotted-quad | ipv6-coloned-hex ) 2740host-list = host [ [ "," ] host-list ] 2741redirhost-list = redirhost [ [ "," ] redirhost-list ] 2742routehost-list = routehost [ [ "," ] routehost-list ] 2743 2744port = "port" ( unary-op | binary-op | "{" op-list "}" ) 2745portspec = "port" ( number | name ) [ ":" ( "*" | number | name ) ] 2746os = "os" ( os-name | "{" os-list "}" ) 2747user = "user" ( unary-op | binary-op | "{" op-list "}" ) 2748group = "group" ( unary-op | binary-op | "{" op-list "}" ) 2749 2750unary-op = [ "=" | "!=" | "<" | "<=" | ">" | ">=" ] 2751 ( name | number ) 2752binary-op = number ( "<>" | "><" | ":" ) number 2753op-list = ( unary-op | binary-op ) [ [ "," ] op-list ] 2754 2755os-name = operating-system-name 2756os-list = os-name [ [ "," ] os-list ] 2757 2758flags = "flags" ( [ flag-set ] "/" flag-set | "any" ) 2759flag-set = [ "F" ] [ "S" ] [ "R" ] [ "P" ] [ "A" ] [ "U" ] [ "E" ] 2760 [ "W" ] 2761 2762icmp-type = "icmp-type" ( icmp-type-code | "{" icmp-list "}" ) 2763icmp6-type = "icmp6-type" ( icmp-type-code | "{" icmp-list "}" ) 2764icmp-type-code = ( icmp-type-name | icmp-type-number ) 2765 [ "code" ( icmp-code-name | icmp-code-number ) ] 2766icmp-list = icmp-type-code [ [ "," ] icmp-list ] 2767 2768tos = ( "lowdelay" | "throughput" | "reliability" | 2769 [ "0x" ] number ) 2770 2771state-opts = state-opt [ [ "," ] state-opts ] 2772state-opt = ( "max" number | "no-sync" | timeout | "sloppy" | 2773 "pflow" | "source-track" [ ( "rule" | "global" ) ] | 2774 "max-src-nodes" number | "max-src-states" number | 2775 "max-src-conn" number | 2776 "max-src-conn-rate" number "/" number | 2777 "overload" "<" string ">" [ "flush" [ "global" ] ] | 2778 "if-bound" | "floating" ) 2779 2780timeout-list = timeout [ [ "," ] timeout-list ] 2781timeout = ( "tcp.first" | "tcp.opening" | "tcp.established" | 2782 "tcp.closing" | "tcp.finwait" | "tcp.closed" | 2783 "udp.first" | "udp.single" | "udp.multiple" | 2784 "icmp.first" | "icmp.error" | 2785 "other.first" | "other.single" | "other.multiple" | 2786 "frag" | "interval" | "src.track" | 2787 "adaptive.start" | "adaptive.end" ) number 2788 2789limit-list = limit-item [ [ "," ] limit-list ] 2790limit-item = ( "states" | "frags" | "src-nodes" | "tables" | 2791 "table-entries" ) number 2792 2793pooltype = ( "bitmask" | "least-states" | 2794 "random" | "round-robin" | 2795 "source-hash" [ ( hex-key | string-key ) ] ) 2796 [ "sticky-address" ] 2797 2798include = "include" filename 2799.Ed 2800.Sh FILES 2801.Bl -tag -width "/etc/protocolsXXX" -compact 2802.It Pa /etc/hosts 2803Host name database. 2804.It Pa /etc/pf.conf 2805Default location of the ruleset file. 2806.It Pa /etc/pf.os 2807Default location of OS fingerprints. 2808.It Pa /etc/protocols 2809Protocol name database. 2810.It Pa /etc/services 2811Service name database. 2812.El 2813.Sh SEE ALSO 2814.Xr pf 4 , 2815.Xr pflow 4 , 2816.Xr pfsync 4 , 2817.Xr pf.os 5 , 2818.Xr pfctl 8 , 2819.Xr pflogd 8 2820.Sh HISTORY 2821The 2822.Nm 2823file format first appeared in 2824.Ox 3.0 . 2825