1.\" $OpenBSD: pfsync.4,v 1.14 2004/03/21 19:47:59 miod Exp $ 2.\" $DragonFly: src/share/man/man4/pfsync.4,v 1.2 2005/08/05 15:35:52 swildner Exp $ 3.\" 4.\" Copyright (c) 2002 Michael Shalayeff 5.\" All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 21.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF MIND, 22.\" USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 25.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26.\" 27.Dd November 29, 2002 28.Dt PFSYNC 4 29.Os 30.Sh NAME 31.Nm pfsync 32.Nd packet filter states table logging interface 33.Sh SYNOPSIS 34.Cd "device pfsync" 35.Sh DESCRIPTION 36The 37.Nm 38interface is a pseudo-device which exposes certain changes to the state 39table used by 40.Xr pf 4 . 41State changes can be viewed by invoking 42.Xr tcpdump 1 43on the 44.Nm 45interface. 46If configured with a physical synchronisation interface, 47.Nm 48will also send state changes out on that interface using IP multicast, 49and insert state changes received on that interface from other systems 50into the state table. 51.Pp 52By default, all local changes to the state table are exposed via 53.Nm . 54However, state changes from packets received by 55.Nm 56over the network are not rebroadcast. 57States created by a rule marked with the 58.Ar no-sync 59keyword are omitted from the 60.Nm 61interface (see 62.Xr pf.conf 5 63for details). 64.Pp 65The 66.Nm 67interface will attempt to collapse multiple updates of the same 68state into one message where possible. 69The maximum number of times this can be done before the update is sent out 70is controlled by the 71.Ar maxupd 72to ifconfig. 73(see 74.Xr ifconfig 8 75and the example below for more details) 76.Pp 77Each packet retrieved on this interface has a header associated 78with it of length 79.Dv PFSYNC_HDRLEN . 80The header indicates the version of the protocol, address family, 81action taken on the following states and the number of state 82table entries attached in this packet. 83This structure, defined in 84.Aq Pa net/if_pfsync.h 85looks like: 86.Bd -literal -offset indent 87struct pfsync_header { 88 u_int8_t version; 89 u_int8_t af; 90 u_int8_t action; 91 u_int8_t count; 92}; 93.Ed 94.Sh NETWORK SYNCHRONISATION 95States can be synchronised between two or more firewalls using this 96interface, by specifying a synchronisation interface using 97.Xr ifconfig 8 . 98For example, the following command sets fxp0 as the synchronisation 99interface. 100.Bd -literal -offset indent 101# ifconfig pfsync0 syncif fxp0 102.Ed 103.Pp 104State change messages are sent out on the synchronisation 105interface using IP multicast packets. 106The protocol is IP protocol 240, PFSYNC, and the multicast group 107used is 224.0.0.240. 108.Pp 109It is important that the synchronisation interface be on a trusted 110network as there is no authentication on the protocol and it would 111be trivial to spoof packets which create states, bypassing the pf ruleset. 112Ideally, this is a network dedicated to pfsync messages, 113i.e. a crossover cable between two firewalls. 114.Pp 115There is a one-to-one correspondence between packets seen by 116.Xr bpf 4 117on the 118.Nm 119interface, and packets sent out on the synchronisation interface, i.e.\& 120a packet with 4 state deletion messages on 121.Nm 122means that the same 4 deletions were sent out on the synchronisation 123interface. 124However, the actual packet contents may differ as the messages 125sent over the network are "compressed" where possible, containing 126only the necessary information. 127.Sh EXAMPLES 128.Bd -literal -offset indent 129# ifconfig pfsync0 up syncif fxp0 maxupd 64 130# tcpdump -s1500 -evtni pfsync0 131.Ed 132.Sh SEE ALSO 133.Xr tcpdump 1, 134.Xr bpf 4 , 135.Xr inet 4 , 136.Xr inet6 4 , 137.Xr netintro 4 , 138.Xr pf 4 , 139.Xr pf.conf 5 , 140.Xr protocols 5 , 141.Xr ifconfig 8 142.Sh HISTORY 143The 144.Nm 145device first appeared in 146.Ox 3.3 147and was imported into 148.Dx 1.1 149by Devon H. O'Dell and Simon Schubert. 150