1.\" $OpenBSD: pf.conf.5,v 1.536 2014/01/21 03:15:46 schwarze Exp $ 2.\" 3.\" Copyright (c) 2002, Daniel Hartmeier 4.\" Copyright (c) 2003 - 2013 Henning Brauer <henning@openbsd.org> 5.\" All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 11.\" - Redistributions of source code must retain the above copyright 12.\" notice, this list of conditions and the following disclaimer. 13.\" - Redistributions in binary form must reproduce the above 14.\" copyright notice, this list of conditions and the following 15.\" disclaimer in the documentation and/or other materials provided 16.\" with the distribution. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19.\" "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 20.\" LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 21.\" FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 22.\" COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 23.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 24.\" BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 25.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 26.\" CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 28.\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29.\" POSSIBILITY OF SUCH DAMAGE. 30.\" 31.Dd $Mdocdate: January 21 2014 $ 32.Dt PF.CONF 5 33.Os 34.Sh NAME 35.Nm pf.conf 36.Nd packet filter configuration file 37.Sh DESCRIPTION 38The 39.Xr pf 4 40packet filter modifies, drops, or passes packets according to rules or 41definitions specified in 42.Nm . 43.Pp 44This is an overview of the sections in this manual page: 45.Bl -ohang 46.It Sy Packet Filtering 47Packet filtering, including network address translation (NAT). 48.It Sy Options 49Global options tune the behaviour of the packet filtering engine. 50.It Sy Queueing 51Queueing provides rule-based bandwidth control. 52.It Sy Tables 53Tables provide a method for dealing with large numbers of addresses. 54.It Sy Anchors 55Anchors are containers for rules and tables. 56.It Sy Stateful Filtering 57Stateful filtering tracks packets by state. 58.It Sy Traffic Normalisation 59Including scrub, fragment handling, and blocking spoofed traffic. 60.It Sy Operating System Fingerprinting 61A method for detecting a host's operating system. 62.It Sy Examples 63Some example rulesets. 64.El 65.Pp 66The current line can be extended over multiple lines using a backslash 67.Pq Sq \e . 68Comments can be put anywhere in the file using a hash mark 69.Pq Sq # , 70and extend to the end of the current line. 71Care should be taken when commenting out multi-line text: 72the comment is effective until the end of the entire block. 73.Pp 74Argument names not beginning with a letter, digit, or underscore 75must be quoted. 76.Pp 77Additional configuration files can be included with the 78.Ic include 79keyword, for example: 80.Bd -literal -offset indent 81include "/etc/pf/sub.filter.conf" 82.Ed 83.Pp 84Macros can be defined that will later be expanded in context. 85Macro names must start with a letter, digit, or underscore, 86and may contain any of those characters. 87Macro names may not be reserved words (for example 88.Ar pass , 89.Ar in , 90.Ar out ) . 91Macros are not expanded inside quotes. 92.Pp 93For example: 94.Bd -literal -offset indent 95ext_if = "kue0" 96all_ifs = "{" $ext_if lo0 "}" 97pass out on $ext_if from any to any 98pass in on $ext_if proto tcp from any to any port 25 99.Ed 100.Sh PACKET FILTERING 101.Xr pf 4 102has the ability to 103.Ar block , 104.Ar pass , 105and 106.Ar match 107packets based on attributes of their layer 3 108and layer 4 headers. 109Filter rules determine which of these actions are taken; 110filter parameters specify the packets to which a rule applies. 111.Pp 112For each packet processed by the packet filter, the filter rules are 113evaluated in sequential order, from first to last. 114For 115.Ar block 116and 117.Ar pass , 118the last matching rule decides what action is taken; 119if no rule matches the packet, the default action is to pass 120the packet without creating a state. 121For 122.Ar match , 123rules are evaluated every time they match; 124the pass/block state of a packet remains unchanged. 125.Pp 126Most parameters are optional. 127If a parameter is specified, the rule only applies to packets with 128matching attributes. 129Certain parameters can be expressed as lists, in which case 130.Xr pfctl 8 131generates all needed rule combinations. 132.Pp 133By default 134.Xr pf 4 135filters packets statefully: 136the first time a packet matches a 137.Ar pass 138rule, a state entry is created. 139The packet filter examines each packet to see if it matches an existing state. 140If it does, the packet is passed without evaluation of any rules. 141After the connection is closed or times out, the state entry is automatically 142removed. 143.Pp 144The following actions can be used in the filter: 145.Bl -tag -width xxxx 146.It Ar block 147The packet is blocked. 148There are a number of ways in which a 149.Ar block 150rule can behave when blocking a packet. 151The default behaviour is to 152.Ar drop 153packets silently, however this can be overridden or made 154explicit either globally, by setting the 155.Ar block-policy 156option, or on a per-rule basis with one of the following options: 157.Pp 158.Bl -tag -width "return-icmp6XXX" -compact 159.It Ar drop 160The packet is silently dropped. 161.It Ar return 162This causes a TCP RST to be returned for TCP packets 163and an ICMP UNREACHABLE for other types of packets. 164.It Ar return-icmp 165.It Ar return-icmp6 166This causes ICMP messages to be returned for packets which match the rule. 167By default this is an ICMP UNREACHABLE message, however this 168can be overridden by specifying a message as a code or number. 169.It Ar return-rst 170This applies only to TCP packets, 171and issues a TCP RST which closes the connection. 172An optional parameter, 173.Ar ttl , 174may be given with a TTL value. 175.El 176.Pp 177Options returning ICMP packets currently have no effect if 178.Xr pf 4 179operates on a 180.Xr bridge 4 , 181as the code to support this feature has not yet been implemented. 182.Pp 183The simplest mechanism to block everything by default and only pass 184packets that match explicit rules is specify a first filter rule of: 185.Pp 186.Dl block all 187.It Ar match 188The packet is matched. 189This mechanism is used to provide fine grained filtering 190without altering the block/pass state of a packet. 191.Ar match 192rules differ from block and pass rules in that 193parameters are set every time a packet matches the rule, 194not only on the last matching rule. 195For the following parameters, 196this means that the parameter effectively becomes 197.Dq sticky 198until explicitly overridden: 199.Ar nat-to , 200.Ar binat-to , 201.Ar rdr-to , 202.Ar queue , 203.Ar rtable , 204and 205.Ar scrub . 206.Pp 207.Ar log 208is different still, 209in that the action happens every time a rule matches 210i.e. a single packet can get logged more than once. 211.It Ar pass 212The packet is passed; 213state is created unless the 214.Ar no state 215option is specified. 216.El 217.Pp 218The following parameters can be used in the filter: 219.Bl -tag -width Ds 220.It Ar in No or Ar out 221A packet always comes in on, or goes out through, one interface. 222.Ar in 223and 224.Ar out 225apply to incoming and outgoing packets; 226if neither are specified, 227the rule will match packets in both directions. 228.It Ar log 229In addition to the action specified, a log message is generated. 230Only the packet that establishes the state is logged, 231unless the 232.Ar no state 233option is specified. 234The logged packets are sent to a 235.Xr pflog 4 236interface, by default 237.Ar pflog0 . 238This interface is monitored by the 239.Xr pflogd 8 240logging daemon, which dumps the logged packets to the file 241.Pa /var/log/pflog 242in 243.Xr pcap 3 244binary format. 245.It Ar log Pq Ar all 246Used to force logging of all packets for a connection. 247This is not necessary when 248.Ar no state 249is explicitly specified. 250As with 251.Ar log , 252packets are logged to 253.Xr pflog 4 . 254.It Ar log Pq Ar matches 255Used to force logging of this packet on all subsequent matching rules. 256.It Ar log Pq Ar user 257Logs the UID and PID of the 258socket on the local host used to send or receive a packet, 259in addition to the normal information. 260.It Ar log Pq Ar to Aq Ar interface 261Send logs to the specified 262.Xr pflog 4 263interface instead of 264.Ar pflog0 . 265.It Ar quick 266If a packet matches a rule which has the 267.Ar quick 268option set, this rule 269is considered the last matching rule, and evaluation of subsequent rules 270is skipped. 271.It Ar on Aq Ar interface 272This rule applies only to packets coming in on, or going out through, this 273particular interface or interface group. 274For more information on interface groups, 275see the 276.Ic group 277keyword in 278.Xr ifconfig 8 . 279.Ar any 280will match any existing interface except loopback ones. 281.It Ar on Ar rdomain Aq Ar number 282This rule applies only to packets coming in on, or going out through, this 283particular routing domain. 284.It Aq Ar af 285This rule applies only to packets of this address family. 286Supported values are 287.Ar inet 288and 289.Ar inet6 . 290.It Ar proto Aq Ar protocol 291This rule applies only to packets of this protocol. 292Common protocols are ICMP, ICMP6, TCP, and UDP. 293For a list of all the protocol name to number mappings used by 294.Xr pfctl 8 , 295see the file 296.Em /etc/protocols . 297.It Xo 298.Ar from Aq Ar source 299.Ar port Aq Ar source 300.Ar os Aq Ar source 301.Ar to Aq Ar dest 302.Ar port Aq Ar dest 303.Xc 304This rule applies only to packets with the specified source and destination 305addresses and ports. 306.Pp 307Addresses can be specified in CIDR notation (matching netblocks), as 308symbolic host names, interface names or interface group names, or as any 309of the following keywords: 310.Pp 311.Bl -tag -width xxxxxxxxxxxxxx -compact 312.It Ar any 313Any address. 314.It Ar no-route 315Any address which is not currently routable. 316.It Ar route Aq Ar label 317Any address matching the given 318.Xr route 8 319label. 320.It Ar self 321Expands to all addresses assigned to all interfaces. 322.It Aq Ar table 323Any address matching the given table. 324.It Ar urpf-failed 325Any source address that fails a unicast reverse path forwarding (URPF) 326check, i.e. packets coming in on an interface other than that which holds 327the route back to the packet's source address. 328.El 329.Pp 330Ranges of addresses are specified using the 331.Sq - 332operator. 333For instance: 334.Dq 10.1.1.10 - 10.1.1.12 335means all addresses from 10.1.1.10 to 10.1.1.12, 336hence addresses 10.1.1.10, 10.1.1.11, and 10.1.1.12. 337.Pp 338Interface names, interface group names, and 339.Ar self 340can have modifiers appended: 341.Pp 342.Bl -tag -width xxxxxxxxxxxx -compact 343.It Ar :0 344Do not include interface aliases. 345.It Ar :broadcast 346Translates to the interface's broadcast address(es). 347.It Ar :network 348Translates to the network(s) attached to the interface. 349.It Ar :peer 350Translates to the point-to-point interface's peer address(es). 351.El 352.Pp 353Host names may also have the 354.Ar :0 355option appended to restrict the name resolution to the first of each 356v4 and v6 address found. 357.Pp 358Host name resolution and interface to address translation are done at 359ruleset load-time. 360When the address of an interface (or host name) changes (under DHCP or PPP, 361for instance), the ruleset must be reloaded for the change to be reflected 362in the kernel. 363Surrounding the interface name (and optional modifiers) in parentheses 364changes this behaviour. 365When the interface name is surrounded by parentheses, the rule is 366automatically updated whenever the interface changes its address. 367The ruleset does not need to be reloaded. 368This is especially useful with 369.Ar nat . 370.Pp 371Ports can be specified either by number or by name. 372For example, port 80 can be specified as 373.Em www . 374For a list of all port name to number mappings used by 375.Xr pfctl 8 , 376see the file 377.Pa /etc/services . 378.Pp 379Ports and ranges of ports are specified using these operators: 380.Bd -literal -offset indent 381= (equal) 382!= (unequal) 383\*(Lt (less than) 384\*(Le (less than or equal) 385\*(Gt (greater than) 386\*(Ge (greater than or equal) 387: (range including boundaries) 388\*(Gt\*(Lt (range excluding boundaries) 389\*(Lt\*(Gt (except range) 390.Ed 391.Pp 392.Sq \*(Gt\*(Lt , 393.Sq \*(Lt\*(Gt 394and 395.Sq \&: 396are binary operators (they take two arguments). 397For instance: 398.Bl -tag -width Ds 399.It port 2000:2004 400means 401.Sq all ports \*(Ge 2000 and \*(Le 2004 , 402hence ports 2000, 2001, 2002, 2003, and 2004. 403.It port 2000 \*(Gt\*(Lt 2004 404means 405.Sq all ports \*(Gt 2000 and \*(Lt 2004 , 406hence ports 2001, 2002, and 2003. 407.It port 2000 \*(Lt\*(Gt 2004 408means 409.Sq all ports \*(Lt 2000 or \*(Gt 2004 , 410hence ports 1\(en1999 and 2005\(en65535. 411.El 412.Pp 413The operating system of the source host can be specified in the case of TCP 414rules with the 415.Ar os 416modifier. 417See the 418.Sx OPERATING SYSTEM FINGERPRINTING 419section for more information. 420.Pp 421The host, port, and OS specifications are optional, 422as in the following examples: 423.Bd -literal -offset indent 424pass in all 425pass in from any to any 426pass in proto tcp from any port \*(Lt 1024 to any 427pass in proto tcp from any to any port 25 428pass in proto tcp from 10.0.0.0/8 port \*(Ge 1024 \e 429 to ! 10.1.2.3 port != ssh 430pass in proto tcp from any os "OpenBSD" 431pass in proto tcp from route "DTAG" 432.Ed 433.El 434.Pp 435The following additional parameters can be used in the filter: 436.Pp 437.Bl -tag -width Ds -compact 438.It Ar all 439This is equivalent to "from any to any". 440.Pp 441.It Ar allow-opts 442By default, IPv4 packets with IP options or IPv6 packets with routing 443extension headers are blocked. 444When 445.Ar allow-opts 446is specified for a 447.Ar pass 448rule, packets that pass the filter based on that rule (last matching) 449do so even if they contain IP options or routing extension headers. 450For packets that match state, the rule that initially created the 451state is used. 452The implicit 453.Ar pass 454rule that is used when a packet does not match any rules does not 455allow IP options. 456.Pp 457.It Ar divert-packet Ar port Aq Ar port 458Used to send matching packets to 459.Xr divert 4 460sockets bound to port 461.Ar port . 462If the default option of fragment reassembly is enabled, scrubbing with 463.Ar reassemble tcp 464is also enabled for 465.Ar divert-packet 466rules. 467.Pp 468.It Ar divert-reply 469Used to receive replies for sockets that are bound to addresses 470which are not local to the machine. 471See 472.Xr setsockopt 2 473for information on how to bind these sockets. 474.Pp 475.It Xo Ar divert-to Aq Ar host 476.Ar port Aq Ar port 477.Xc 478Used to redirect packets to a local socket bound to 479.Ar host 480and 481.Ar port . 482The packets will not be modified, so 483.Xr getsockname 2 484on the socket will return the original destination address of the packet. 485.Pp 486.It Xo Ar flags Aq Ar a 487.Pf / Ns Aq Ar b 488.No \*(Ba Ar any 489.Xc 490This rule only applies to TCP packets that have the flags 491.Aq Ar a 492set out of set 493.Aq Ar b . 494Flags not specified in 495.Aq Ar b 496are ignored. 497For stateful connections, the default is 498.Ar flags S/SA . 499To indicate that flags should not be checked at all, specify 500.Ar flags any . 501The flags are: (F)IN, (S)YN, (R)ST, (P)USH, (A)CK, (U)RG, (E)CE, and C(W)R. 502.Bl -tag -width Fl 503.It Ar flags S/S 504Flag SYN is set. 505The other flags are ignored. 506.It Ar flags S/SA 507This is the default setting for stateful connections. 508Out of SYN and ACK, exactly SYN may be set. 509SYN, SYN+PSH, and SYN+RST match, but SYN+ACK, ACK, and ACK+RST do not. 510This is more restrictive than the previous example. 511.It Ar flags /SFRA 512If the first set is not specified, it defaults to none. 513All of SYN, FIN, RST, and ACK must be unset. 514.El 515.Pp 516Because 517.Ar flags S/SA 518is applied by default (unless 519.Ar no state 520is specified), only the initial SYN packet of a TCP handshake will create 521a state for a TCP connection. 522It is possible to be less restrictive, and allow state creation from 523intermediate 524.Pq non-SYN 525packets, by specifying 526.Ar flags any . 527This will cause 528.Xr pf 4 529to synchronize to existing connections, for instance 530if one flushes the state table. 531However, states created from such intermediate packets may be missing 532connection details such as the TCP window scaling factor. 533States which modify the packet flow, such as those affected by 534.Ar af-to , 535.Ar modulate , 536.Ar nat-to , 537.Ar rdr-to , 538or 539.Ar synproxy state 540options, or scrubbed with 541.Ar reassemble tcp , 542will also not be recoverable from intermediate packets. 543Such connections will stall and time out. 544.Pp 545.It Ar group Aq Ar group 546Similar to 547.Ar user , 548this rule only applies to packets of sockets owned by the specified group. 549.Pp 550.It Xo Ar icmp-type Aq Ar type 551.Ar code Aq Ar code 552.Xc 553.It Xo Ar icmp6-type Aq Ar type 554.Ar code Aq Ar code 555.Xc 556This rule only applies to ICMP or ICMP6 packets with the specified type 557and code. 558Text names for ICMP types and codes are listed in 559.Xr icmp 4 560and 561.Xr icmp6 4 . 562The protocol and the ICMP type indicator 563.Po 564.Ar icmp-type 565or 566.Ar icmp6-type 567.Pc 568must match. 569.Pp 570.It Ar label Aq Ar string 571Adds a label to the rule, which can be used to identify the rule. 572For instance, 573.Dq pfctl -s labels 574shows per-rule statistics for rules that have labels. 575.Pp 576The following macros can be used in labels: 577.Pp 578.Bl -tag -width "$srcaddrXXX" -compact -offset indent 579.It Ar $dstaddr 580The destination IP address. 581.It Ar $dstport 582The destination port specification. 583.It Ar $if 584The interface. 585.It Ar $nr 586The rule number. 587.It Ar $proto 588The protocol name. 589.It Ar $srcaddr 590The source IP address. 591.It Ar $srcport 592The source port specification. 593.El 594.Pp 595For example: 596.Bd -literal -offset indent -compact 597ips = "{ 1.2.3.4, 1.2.3.5 }" 598pass in proto tcp from any to $ips \e 599 port \*(Gt 1023 label "$dstaddr:$dstport" 600.Ed 601.Pp 602Expands to: 603.Bd -literal -offset indent -compact 604pass in inet proto tcp from any to 1.2.3.4 \e 605 port \*(Gt 1023 label "1.2.3.4:\*(Gt1023" 606pass in inet proto tcp from any to 1.2.3.5 \e 607 port \*(Gt 1023 label "1.2.3.5:\*(Gt1023" 608.Ed 609.Pp 610The macro expansion for the 611.Ar label 612directive occurs only at configuration file parse time, not during runtime. 613.Pp 614.It Ar once 615Creates a one shot rule that will remove itself from an active ruleset after 616the first match. 617In case this is the only rule in the anchor, the anchor will be destroyed 618automatically after the rule is matched. 619.Pp 620.It Ar probability Aq Ar number 621A probability attribute can be attached to a rule, 622with a value set between 0 and 100%, 623in which case the rule is honoured using the given probability value. 624For example, the following rule will drop 20% of incoming ICMP packets: 625.Pp 626.Dl block in proto icmp probability 20% 627.Pp 628.It Ar received-on Aq Ar interface 629Only match packets which were received on the specified 630.Ar interface 631(or interface group). 632.Ar any 633will match any existing interface except loopback ones. 634.Pp 635.It Ar rtable Aq Ar number 636Used to select an alternate routing table for the routing lookup. 637Only effective before the route lookup happened, i.e. when filtering inbound. 638.Pp 639.It Xo Ar set prio Aq Ar priority 640.No \*(Ba ( Aq Ar priority , 641.Aq Ar priority ) 642.Xc 643Packets matching this rule will be assigned a specific queueing priority. 644Priorities are assigned as integers 0 through 7, 645with a default priority of 3. 646If the packet is transmitted on a 647.Xr vlan 4 648interface, the queueing priority will also be written as the priority 649code point in the 802.1Q VLAN header. 650If two priorities are given, packets which have a TOS of 651.Ar lowdelay 652and TCP ACKs with no data payload will be assigned to the second one. 653Packets with a higher priority number are processed first, 654and packets with the same priority are processed 655in the order in which they are received. 656.Pp 657For example: 658.Bd -literal -offset indent 659pass in proto tcp to port 25 set prio 2 660pass in proto tcp to port 22 set prio (2, 5) 661.Ed 662.Pp 663The interface priority queues accessed by the 664.Ar set prio 665keyword are always enabled and do not require any additional 666configuration, unlike the queues described below and in the 667.Sx QUEUEING 668section. 669.Pp 670.It Xo Ar set queue Aq Ar queue 671.No \*(Ba ( Aq Ar queue , 672.Aq Ar queue ) 673.Xc 674Packets matching this rule will be assigned to the specified queue. 675If two queues are given, packets which have a TOS of 676.Ar lowdelay 677and TCP ACKs with no data payload will be assigned to the second one. 678See 679.Sx QUEUEING 680for setup details. 681.Pp 682For example: 683.Bd -literal -offset indent 684pass in proto tcp to port 25 set queue mail 685pass in proto tcp to port 22 set queue(ssh_bulk, ssh_prio) 686.Ed 687.Pp 688.It Xo Ar set tos Aq Ar string 689.No \*(Ba Aq Ar number 690.Xc 691Enforces a TOS for matching packets. 692.Ar string 693may be one of 694.Ar critical , 695.Ar inetcontrol , 696.Ar lowdelay , 697.Ar netcontrol , 698.Ar throughput , 699.Ar reliability , 700or one of the DiffServ Code Points: 701.Ar ef , 702.Ar af11 ... af43 , 703.Ar cs0 ... cs7 ; 704.Ar number 705may be either a hex or decimal number. 706.Pp 707.It Ar tag Aq Ar string 708Packets matching this rule will be tagged with the 709specified string. 710The tag acts as an internal marker that can be used to 711identify these packets later on. 712This can be used, for example, to provide trust between 713interfaces and to determine if packets have been 714processed by translation rules. 715Tags are 716.Qq sticky , 717meaning that the packet will be tagged even if the rule 718is not the last matching rule. 719Further matching rules can replace the tag with a 720new one but will not remove a previously applied tag. 721A packet is only ever assigned one tag at a time. 722Tags take the same macros as labels (see above). 723.Pp 724.It Ar tagged Aq Ar string 725Used with filter or translation rules 726to specify that packets must already 727be tagged with the given tag in order to match the rule. 728Inverse tag matching can also be done 729by specifying the 730.Cm !\& 731operator before the 732.Ar tagged 733keyword. 734.Pp 735.It Xo Ar tos Aq Ar string 736.No \*(Ba Aq Ar number 737.Xc 738This rule applies to packets with the specified TOS bits set. 739.Ar string 740may be one of 741.Ar critical , 742.Ar inetcontrol , 743.Ar lowdelay , 744.Ar netcontrol , 745.Ar throughput , 746.Ar reliability , 747or one of the DiffServ Code Points: 748.Ar ef , 749.Ar af11 ... af43 , 750.Ar cs0 ... cs7 ; 751.Ar number 752may be either a hex or decimal number. 753.Pp 754For example, the following rules are identical: 755.Bd -literal -offset indent 756pass all tos lowdelay 757pass all tos 0x10 758pass all tos 16 759.Ed 760.Pp 761.It Ar user Aq Ar user 762This rule only applies to packets of sockets owned by the specified user. 763For outgoing connections initiated from the firewall, this is the user 764that opened the connection. 765For incoming connections to the firewall itself, this is the user that 766listens on the destination port. 767.Pp 768When listening sockets are bound to the wildcard address, 769.Xr pf 4 770cannot determine if a connection is destined for the firewall itself. 771To avoid false matches on just the destination port, combine a 772.Ar user 773rule with source or destination address 774.Ar self . 775.Pp 776All packets, both outgoing and incoming, of one connection are associated 777with the same user and group. 778Only TCP and UDP packets can be associated with users. 779.Pp 780User and group refer to the effective (as opposed to the real) IDs, in 781case the socket is created by a setuid/setgid process. 782User and group IDs are stored when a socket is created; 783when a process creates a listening socket as root (for instance, by 784binding to a privileged port) and subsequently changes to another 785user ID (to drop privileges), the credentials will remain root. 786.Pp 787User and group IDs can be specified as either numbers or names. 788The syntax is similar to the one for ports. 789The following example allows only selected users to open outgoing 790connections: 791.Bd -literal -offset indent 792block out proto tcp all 793pass out proto tcp from self user { \*(Lt 1000, dhartmei } 794.Ed 795.El 796.Ss Translation 797Translation options modify either the source or destination address and 798port of the packets associated with a stateful connection. 799.Xr pf 4 800modifies the specified address and/or port in the packet and recalculates 801IP, TCP, and UDP checksums as necessary. 802.Pp 803Subsequent rules will see packets as they look 804after any addresses and ports have been translated. 805These rules will therefore have to filter based on the translated 806address and port number. 807.Pp 808The state entry created permits 809.Xr pf 4 810to keep track of the original address for traffic associated with that state 811and correctly direct return traffic for that connection. 812.Pp 813Different types of translation are possible with pf: 814.Bl -tag -width xxxxxxxx 815.It Ar af-to 816Translation between different address families (NAT64) is handled 817using 818.Ar af-to 819rules. 820Because address family translation overrides the routing table, it's 821only possible to use 822.Ar af-to 823on inbound rules, and a source address for the resulting translation 824must always be specified. 825.Pp 826The optional second argument is the host or subnet the original 827addresses are translated into for the destination. 828The lowest bits of the original destination address form the host 829part of the new destination address according to the specified subnet. 830It is possible to embed a complete IPv4 address into an IPv6 address 831using a network prefix of /96 or smaller. 832.Pp 833When a destination address is not specified it is assumed that the host 834part is 32-bit long. 835For IPv6 to IPv4 translation this would mean using only the lower 32 836bits of the original IPv6 destination address. 837For IPv4 to IPv6 translation the destination subnet defaults to the 838subnet of the new IPv6 source address with a prefix length of /96. 839See RFC 6052 Section 2.2 for details on how the prefix determines the 840destination address encoding. 841.Pp 842For example, the following rules are identical: 843.Bd -literal -offset indent 844pass in inet af-to inet6 from 2001:db8::1 to 2001:db8::/96 845pass in inet af-to inet6 from 2001:db8::1 846.Ed 847.Pp 848In the above example the matching IPv4 packets will be modified to 849have a source address of 2001:db8::1 and a destination address will 850get prefixed with 2001:db8::/96, e.g. 198.51.100.100 will be 851translated to 2001:db8::c633:6464. 852.Pp 853In the reverse case the following rules are identical: 854.Bd -literal -offset indent 855pass in inet6 af-to inet from 198.51.100.1 to 0.0.0.0/0 856pass in inet6 af-to inet from 198.51.100.1 857.Ed 858.Pp 859The destination IPv4 address is assumed to be embedded inside the 860original IPv6 destination address, e.g. 64:ff9b::c633:6464 will be 861translated to 198.51.100.100. 862.Pp 863The current implementation will only extract IPv4 addresses from the 864IPv6 addresses with a prefix length of /96 and greater. 865.It Ar binat-to 866A 867.Ar binat-to 868rule specifies a bidirectional mapping between an external IP 869netblock and an internal IP netblock. 870It expands to an outbound 871.Ar nat-to 872rule and an inbound 873.Ar rdr-to 874rule. 875.It Ar nat-to 876A 877.Ar nat-to 878option specifies that IP addresses are to be changed as the packet 879traverses the given interface. 880This technique allows one or more IP addresses 881on the translating host to support network traffic for a larger range of 882machines on an "inside" network. 883Although in theory any IP address can be used on the inside, it is strongly 884recommended that one of the address ranges defined by RFC 1918 be used. 885Those netblocks are: 886.Bd -literal -offset indent 88710.0.0.0 \(en 10.255.255.255 (all of net 10, i.e. 10/8) 888172.16.0.0 \(en 172.31.255.255 (i.e. 172.16/12) 889192.168.0.0 \(en 192.168.255.255 (i.e. 192.168/16) 890.Ed 891.Pp 892.Ar nat-to 893is usually applied outbound. 894If applied inbound, nat-to to a local IP address is not supported. 895.It Ar rdr-to 896The packet is redirected to another destination and possibly a 897different port. 898.Ar rdr-to 899can optionally specify port ranges instead of single ports. 900For instance: 901.Bl -tag -width Ds 902.It match in ... port 2000:2999 rdr-to ... port 4000 903redirects ports 2000 to 2999 (inclusive) to port 4000. 904.It match in ... port 2000:2999 rdr-to ... port 4000:* 905redirects port 2000 to 4000, port 2001 to 4001, ..., port 2999 to 4999. 906.El 907.Pp 908.Ar rdr-to 909is usually applied inbound. 910If applied outbound, rdr-to to a local IP address is not supported. 911.El 912.Pp 913In addition to modifying the address, some translation rules may modify 914source or destination ports for TCP or UDP connections; 915implicitly in the case of 916.Ar nat-to 917options and explicitly in the case of 918.Ar rdr-to 919ones. 920Port numbers are never translated with a 921.Ar binat-to 922rule. 923.Pp 924Translation options apply only to packets that pass through the specified 925interface, and if no interface is specified, translation is applied 926to packets on all interfaces. 927For instance, redirecting port 80 on an external interface to an internal 928web server will only work for connections originating from the outside. 929Connections to the address of the external interface from local hosts will 930not be redirected, since such packets do not actually pass through the 931external interface. 932Redirections cannot reflect packets back through the interface they arrive 933on, they can only be redirected to hosts connected to different interfaces 934or to the firewall itself. 935.Pp 936However packets may be redirected to hosts connected to the interface the 937packet arrived on by using redirection with NAT. 938For example: 939.Bd -literal -offset indent 940pass in on $int_if proto tcp from $int_net to $ext_if port 80 \e 941 rdr-to $server 942pass out on $int_if proto tcp to $server port 80 \e 943 received-on $int_if nat-to $int_if 944.Ed 945.Pp 946Note that redirecting external incoming connections to the loopback address 947will effectively allow an external host to connect to daemons 948bound solely to the loopback address, circumventing the traditional 949blocking of such connections on a real interface. 950For example: 951.Bd -literal -offset indent 952pass in on egress proto tcp from any to any port smtp \e 953 rdr-to 127.0.0.1 port spamd 954.Ed 955.Pp 956Unless this effect is desired, any of the local non-loopback addresses 957should be used instead as the redirection target, which allows external 958connections only to daemons bound to this address or not bound to 959any address. 960.Pp 961For 962.Ar af-to , 963.Ar nat-to 964and 965.Ar rdr-to 966options for which there is a single redirection address which has a 967subnet mask smaller than 32 for IPv4 or 128 for IPv6 (more than one IP 968address), a variety of different methods for assigning this address can be 969used: 970.Bl -tag -width xxxx 971.It Ar bitmask 972The 973.Ar bitmask 974option applies the network portion of the redirection address to the address 975to be modified (source with 976.Ar nat-to , 977destination with 978.Ar rdr-to ) . 979.It Ar least-states Op Ar sticky-address 980The 981.Ar least-states 982option selects the address with the least active states from 983a given address pool and considers given weights 984associated with address(es). 985Weights can be specified between 1 and 65535. 986Addresses with higher weights are selected more often. 987.Pp 988.Ar sticky-address 989can be specified to ensure that multiple connections from the 990same source are mapped to the same redirection address. 991Associations are destroyed as soon as there are 992no longer states which refer to them; 993in order to make the mappings last 994beyond the lifetime of the states, 995increase the global options with 996.Ar set timeout src.track . 997.It Ar random Op Ar sticky-address 998The 999.Ar random 1000option selects an address at random within the defined block of addresses. 1001.Ar sticky-address 1002is as described above. 1003.It Ar round-robin Op Ar sticky-address 1004The 1005.Ar round-robin 1006option loops through the redirection address(es) and considers given weights 1007associated with address(es). 1008Weights can be specified between 1 and 65535. 1009Addresses with higher weights are selected more often. 1010.Ar sticky-address 1011is as described above. 1012.It Ar source-hash Op Ar key 1013The 1014.Ar source-hash 1015option uses a hash of the source address to determine the redirection address, 1016ensuring that the redirection address is always the same for a given source. 1017An optional 1018.Ar key 1019can be specified after this keyword either in hex or as a string; 1020by default 1021.Xr pfctl 8 1022randomly generates a key for source-hash every time the 1023ruleset is reloaded. 1024.It Ar static-port 1025With 1026.Ar nat 1027rules, the 1028.Ar static-port 1029option prevents 1030.Xr pf 4 1031from modifying the source port on TCP and UDP packets. 1032.El 1033.Pp 1034When more than one redirection address or a table is specified, 1035.Ar round-robin 1036and 1037.Ar least-states 1038are the only permitted pool types. 1039.Ss Routing 1040If a packet matches a rule with one of the following route options set, 1041the packet filter will route the packet according to the type of route option. 1042When such a rule creates state, the route option is also applied to all 1043packets matching the same connection. 1044.Bl -tag -width xxxx 1045.It Ar dup-to 1046The 1047.Ar dup-to 1048option creates a duplicate of the packet and routes it like 1049.Ar route-to . 1050The original packet gets routed as it normally would. 1051.It Ar reply-to 1052The 1053.Ar reply-to 1054option is similar to 1055.Ar route-to , 1056but routes packets that pass in the opposite direction (replies) to the 1057specified interface. 1058Opposite direction is only defined in the context of a state entry, and 1059.Ar reply-to 1060is useful only in rules that create state. 1061It can be used on systems with multiple external connections to 1062route all outgoing packets of a connection through the interface 1063the incoming connection arrived through (symmetric routing enforcement). 1064.It Ar route-to 1065The 1066.Ar route-to 1067option routes the packet to the specified interface with an optional address 1068for the next hop. 1069When a 1070.Ar route-to 1071rule creates state, only packets that pass in the same direction as the 1072filter rule specifies will be routed in this way. 1073Packets passing in the opposite direction (replies) are not affected 1074and are routed normally. 1075.El 1076.Pp 1077For the 1078.Ar dup-to , 1079.Ar reply-to , 1080and 1081.Ar route-to 1082route options 1083for which there is a single redirection address which has a 1084subnet mask smaller than 32 for IPv4 or 128 for IPv6 (more than one IP 1085address), 1086the methods 1087.Ar least-states , 1088.Ar random , 1089.Ar round-robin , 1090and 1091.Ar source-hash , 1092as described above, 1093can be used. 1094.Sh OPTIONS 1095.Xr pf 4 1096may be tuned for various situations using the 1097.Ar set 1098command. 1099.Bl -tag -width Ds 1100.It Ar set block-policy 1101The 1102.Ar block-policy 1103option sets the default behaviour for the packet 1104.Ar block 1105action: 1106.Pp 1107.Bl -tag -width xxxxxxxx -compact 1108.It Ar drop 1109Packet is silently dropped. 1110.It Ar return 1111A TCP RST is returned for blocked TCP packets, 1112an ICMP UNREACHABLE is returned for blocked UDP packets, 1113and all other packets are silently dropped. 1114.El 1115.It Ar set debug 1116Set the debug 1117.Ar level , 1118which limits the severity of log messages printed by 1119.Xr pf 4 . 1120This should be a keyword from the following ordered list 1121(highest to lowest): 1122.Cm emerg , 1123.Cm alert , 1124.Cm crit , 1125.Cm err , 1126.Cm warning , 1127.Cm notice , 1128.Cm info , 1129and 1130.Cm debug . 1131These keywords correspond to the similar (LOG_) values specified to the 1132.Xr syslog 3 1133library routine. 1134.It Ar set fingerprints 1135Load fingerprints of known operating systems from the given filename. 1136By default fingerprints of known operating systems are automatically 1137loaded from 1138.Xr pf.os 5 , 1139but can be overridden via this option. 1140Setting this option may leave a small period of time where the fingerprints 1141referenced by the currently active ruleset are inconsistent until the new 1142ruleset finishes loading. 1143.It Ar set hostid 1144The 32-bit 1145.Ar hostid 1146identifies this firewall's state table entries to other firewalls 1147in a 1148.Xr pfsync 4 1149failover cluster. 1150By default the hostid is set to a pseudo-random value, however it may be 1151desirable to manually configure it, for example to more easily identify the 1152source of state table entries. 1153The hostid may be specified in either decimal or hexadecimal. 1154.It Ar set limit 1155Sets hard limits on the memory pools used by the packet filter. 1156See 1157.Xr pool 9 1158for an explanation of memory pools. 1159.Pp 1160For example, 1161to set the maximum number of entries in the memory pool used by state table 1162entries (generated by 1163.Ar pass 1164rules which do not specify 1165.Ar no state ) 1166to 20000: 1167.Pp 1168.Dl set limit states 20000 1169.Pp 1170To set the maximum number of entries in the memory pool used for fragment 1171reassembly to 2000: 1172.Pp 1173.Dl set limit frags 2000 1174.Pp 1175This maximum may not exceed, and should be well below, the maximum number 1176of mbuf clusters 1177.Pq sysctl kern.maxclusters 1178in the system. 1179.Pp 1180To set the maximum number of entries in the memory pool used for tracking 1181source IP addresses (generated by the 1182.Ar sticky-address 1183and 1184.Ar src.track 1185options) to 2000: 1186.Pp 1187.Dl set limit src-nodes 2000 1188.Pp 1189To set limits on the memory pools used by tables: 1190.Bd -literal -offset indent 1191set limit tables 1000 1192set limit table-entries 100000 1193.Ed 1194.Pp 1195The first limits the number of tables that can exist to 1000. 1196The second limits the overall number of addresses that can be stored 1197in tables to 100000. 1198.Pp 1199Various limits can be combined on a single line: 1200.Bd -literal -offset indent 1201set limit { states 20000, frags 2000, src-nodes 2000 } 1202.Ed 1203.It Ar set loginterface 1204Enable collection of packet and byte count statistics for the given 1205interface or interface group. 1206These statistics can be viewed using: 1207.Pp 1208.Dl # pfctl -s info 1209.Pp 1210In this example 1211.Xr pf 4 1212collects statistics on the interface named dc0: 1213.Pp 1214.Dl set loginterface dc0 1215.Pp 1216One can disable the loginterface using: 1217.Pp 1218.Dl set loginterface none 1219.It Ar set optimization 1220Optimize state timeouts for one of the following network environments: 1221.Pp 1222.Bl -tag -width Ds -compact 1223.It Ar aggressive 1224Aggressively expire connections. 1225This can greatly reduce the memory usage of the firewall at the cost of 1226dropping idle connections early. 1227.It Ar conservative 1228Extremely conservative settings. 1229Avoid dropping legitimate connections at the 1230expense of greater memory utilization (possibly much greater on a busy 1231network) and slightly increased processor utilization. 1232.It Ar high-latency 1233A high-latency environment (such as a satellite connection). 1234.It Ar normal 1235A normal network environment. 1236Suitable for almost all networks. 1237.It Ar satellite 1238Alias for 1239.Ar high-latency . 1240.El 1241.It Ar set reassemble 1242The 1243.Ar reassemble 1244option is used to enable or disable the reassembly of fragmented packets, 1245and can be set to 1246.Ar yes 1247(the default) or 1248.Ar no . 1249If 1250.Ar no-df 1251is also specified, fragments with the 1252.Ar dont-fragment 1253bit set are reassembled too, 1254instead of being dropped; 1255the reassembled packet will have the 1256.Ar dont-fragment 1257bit cleared. 1258.It Ar set ruleset-optimization 1259.Bl -tag -width xxxxxxxx -compact 1260.It Ar basic 1261Enable basic ruleset optimization. 1262This is the default behaviour. 1263Basic ruleset optimization does four things to improve the 1264performance of ruleset evaluations: 1265.Pp 1266.Bl -enum -compact 1267.It 1268remove duplicate rules 1269.It 1270remove rules that are a subset of another rule 1271.It 1272combine multiple rules into a table when advantageous 1273.It 1274re-order the rules to improve evaluation performance 1275.El 1276.It Ar none 1277Disable the ruleset optimizer. 1278.It Ar profile 1279Uses the currently loaded ruleset as a feedback profile to tailor the 1280ordering of quick rules to actual network traffic. 1281.El 1282.Pp 1283It is important to note that the ruleset optimizer will modify the ruleset 1284to improve performance. 1285A side effect of the ruleset modification is that per-rule accounting 1286statistics will have different meanings than before. 1287If per-rule accounting is important for billing purposes or whatnot, 1288either the ruleset optimizer should not be used or a label field should 1289be added to all of the accounting rules to act as optimization barriers. 1290.Pp 1291Optimization can also be set as a command-line argument to 1292.Xr pfctl 8 , 1293overriding the settings in 1294.Nm . 1295.It Ar set skip on Aq Ar ifspec 1296List interfaces for which packets should not be filtered. 1297Packets passing in or out on such interfaces are passed as if pf was 1298disabled, i.e. pf does not process them in any way. 1299This can be useful on loopback and other virtual interfaces, when 1300packet filtering is not desired and can have unexpected effects. 1301.Ar ifspec 1302is only evaluated when the ruleset is loaded; interfaces created 1303later will not be skipped. 1304.It Ar set state-defaults 1305The 1306.Ar state-defaults 1307option sets the state options for states created from rules 1308without an explicit 1309.Ar keep state . 1310For example: 1311.Pp 1312.Dl set state-defaults pflow, no-sync 1313.It Ar set state-policy 1314The 1315.Ar state-policy 1316option sets the default behaviour for states: 1317.Pp 1318.Bl -tag -width if-bound -compact 1319.It Ar if-bound 1320States are bound to an interface. 1321.It Ar floating 1322States can match packets on any interfaces (the default). 1323.El 1324.It Ar set timeout 1325.Bl -tag -width "src.track" -compact 1326.It Ar frag 1327Seconds before an unassembled fragment is expired. 1328.It Ar interval 1329Interval between purging expired states and fragments. 1330.It Ar src.track 1331Length of time to retain a source tracking entry after the last state 1332expires. 1333.El 1334.Pp 1335When a packet matches a stateful connection, the seconds to live for the 1336connection will be updated to that of the 1337protocol and modifier 1338which corresponds to the connection state. 1339Each packet which matches this state will reset the TTL. 1340Tuning these values may improve the performance of the 1341firewall at the risk of dropping valid idle connections. 1342.Pp 1343.Bl -tag -width Ds -compact 1344.It Ar tcp.closed 1345The state after one endpoint sends an RST. 1346.It Ar tcp.closing 1347The state after the first FIN has been sent. 1348.It Ar tcp.established 1349The fully established state. 1350.It Ar tcp.finwait 1351The state after both FINs have been exchanged and the connection is closed. 1352Some hosts (notably web servers on Solaris) send TCP packets even after closing 1353the connection. 1354Increasing 1355.Ar tcp.finwait 1356(and possibly 1357.Ar tcp.closing ) 1358can prevent blocking of such packets. 1359.It Ar tcp.first 1360The state after the first packet. 1361.It Ar tcp.opening 1362The state after the second packet but before both endpoints have 1363acknowledged the connection. 1364.El 1365.Pp 1366ICMP and UDP are handled in a fashion similar to TCP, but with a much more 1367limited set of states: 1368.Pp 1369.Bl -tag -width Ds -compact 1370.It Ar icmp.error 1371The state after an ICMP error came back in response to an ICMP packet. 1372.It Ar icmp.first 1373The state after the first packet. 1374.It Ar udp.first 1375The state after the first packet. 1376.It Ar udp.multiple 1377The state if both hosts have sent packets. 1378.It Ar udp.single 1379The state if the source host sends more than one packet but the destination 1380host has never sent one back. 1381.El 1382.Pp 1383Other protocols are handled similarly to UDP: 1384.Pp 1385.Bl -tag -width xxxx -compact 1386.It Ar other.first 1387.It Ar other.multiple 1388.It Ar other.single 1389.El 1390.Pp 1391Timeout values can be reduced adaptively as the number of state table 1392entries grows. 1393.Pp 1394.Bl -tag -width Ds -compact 1395.It Ar adaptive.end 1396When reaching this number of state entries, all timeout values become 1397zero, effectively purging all state entries immediately. 1398This value is used to define the scale factor; it should not actually 1399be reached (set a lower state limit, see below). 1400.It Ar adaptive.start 1401When the number of state entries exceeds this value, adaptive scaling 1402begins. 1403All timeout values are scaled linearly with factor 1404(adaptive.end \- number of states) / (adaptive.end \- adaptive.start). 1405.El 1406.Pp 1407Adaptive timeouts are enabled by default, with an adaptive.start value 1408equal to 60% of the state limit, and an adaptive.end value equal to 1409120% of the state limit. 1410They can be disabled by setting both adaptive.start and adaptive.end to 0. 1411.Pp 1412The adaptive timeout values can be defined both globally and for each rule. 1413When used on a per-rule basis, the values relate to the number of 1414states created by the rule, otherwise to the total number of 1415states. 1416.Pp 1417For example: 1418.Bd -literal -offset indent 1419set timeout tcp.first 120 1420set timeout tcp.established 86400 1421set timeout { adaptive.start 6000, adaptive.end 12000 } 1422set limit states 10000 1423.Ed 1424.Pp 1425With 9000 state table entries, the timeout values are scaled to 50% 1426(tcp.first 60, tcp.established 43200). 1427.El 1428.Sh QUEUEING 1429Packets can be assigned to queues for the purpose of bandwidth 1430control. 1431At least one declaration is required to configure queues, and later 1432any packet filtering rule can reference the defined queues by name. 1433During the filtering component of 1434.Nm , 1435the last referenced 1436.Ar queue 1437name is where any passed packets will be queued, while for 1438blocked packets it specifies where any resulting ICMP or TCP RST 1439packets should be queued. 1440If the referenced queue does not exist on the outgoing interface the 1441default queue for that interface is used. 1442Queues attached to an interface build a tree, 1443thus each queue can have further child queues. 1444Only leaf queues, i.e. queues without children, can be used to assign 1445packets to. 1446The root queue must specifically reference an interface, all other queues 1447pick up the interface(s) they should be created on from their parent queues 1448unless explicitly specified. 1449.Pp 1450In the following example, a queue named std is created on the interface em0, 1451with 3 child queues ssh, mail and http. 1452.Bd -literal -offset indent 1453queue std on em0 bandwidth 100M 1454queue ssh parent std bandwidth 10M 1455queue mail parent std bandwidth 10M 1456queue http parent std bandwidth 80M default 1457.Ed 1458.Pp 1459The specified bandwidth is the target bandwidth, every queue can receive 1460more bandwidth as long as the parent still has some available. 1461The maximum bandwidth that should be assigned to a given queue can be limited 1462using the 1463.Ar max 1464keyword. 1465Similarily, a minimum (reserved) bandwidth can be specified. 1466.Bd -literal -offset indent 1467queue ssh parent std bandwidth 10M, min 5M, max 25M 1468.Ed 1469.Pp 1470For each of these 3 bandwidth specifications an additional burst bandwidth and 1471time can be specified. 1472.Bd -literal -offset indent 1473queue ssh parent std bandwidth 10M burst 90M for 100ms 1474.Ed 1475.Pp 1476All 1477.Ar bandwidth 1478values must be specified as an absolute value. 1479The suffixes 1480.Ar K , 1481.Ar M , 1482and 1483.Ar G 1484are used to represent bits, kilobits, megabits, and 1485gigabits per second, respectively. 1486The value must not exceed the interface bandwidth. 1487.Pp 1488In addition to the bandwidth specifications queues support the following 1489options: 1490.Bl -tag -width xxxx 1491.It Ar default 1492Packets not matched by another queue are assigned to this queue. 1493Exactly one default queue per interface is required. 1494.It Ar on Aq Ar interface 1495Specifies the interface the queue operates on. 1496If not given, it operates on all matching interfaces. 1497.It Ar parent Aq Ar name 1498Defines which parent queue the queue should be attached to. 1499Mandantory for all queues except root queues. 1500The parent queue must exist. 1501.It Ar qlimit Aq Ar limit 1502The maximum number of packets held in the queue. 1503The default is 50. 1504.El 1505.Pp 1506Packets can be assigned to queues based on filter rules by using the 1507.Ar queue 1508keyword. 1509Normally only one 1510.Ar queue 1511is specified; when a second one is specified it will instead be used for 1512packets which have a TOS of 1513.Ar lowdelay 1514and for TCP ACKs with no data payload. 1515.Pp 1516To continue the previous example, the examples below would specify the 1517four referenced 1518queues, plus a few child queues. 1519Interactive 1520.Xr ssh 1 1521sessions get priority over bulk transfers like 1522.Xr scp 1 1523and 1524.Xr sftp 1 . 1525The queues are then referenced by filtering rules (see 1526.Sx PACKET FILTERING , 1527above). 1528.Bd -literal -offset 4n 1529queue rootq on em0 bandwidth 100M max 100M 1530queue http parent rootq bandwidth 60M burst 90M for 100ms 1531queue developers parent http bandwidth 45M 1532queue employees parent http bandwidth 15M 1533queue mail parent rootq bandwidth 10M 1534queue ssh parent rootq bandwidth 20M 1535queue ssh_interactive parent ssh bandwidth 10M min 5M 1536queue ssh_bulk parent ssh bandwidth 10M 1537queue std parent rootq bandwidth 20M default 1538 1539block return out on em0 inet all set queue std 1540pass out on em0 inet proto tcp from $developerhosts to any port 80 \e 1541 set queue developers 1542pass out on em0 inet proto tcp from $employeehosts to any port 80 \e 1543 set queue employees 1544pass out on em0 inet proto tcp from any to any port 22 \e 1545 set (queue(ssh_bulk, ssh_interactive), prio (3, 6)) 1546pass out on em0 inet proto tcp from any to any port 25 \e 1547 set queue mail 1548.Ed 1549.Sh TABLES 1550Tables are named structures which can hold a collection of addresses and 1551networks. 1552Lookups against tables in 1553.Xr pf 4 1554are relatively fast, making a single rule with tables much more efficient, 1555in terms of 1556processor usage and memory consumption, than a large number of rules which 1557differ only in IP address (either created explicitly or automatically by rule 1558expansion). 1559.Pp 1560Tables can be used as the source or destination of filter 1561or translation rules. 1562They can also be used for the redirect address of 1563.Ar nat-to 1564and 1565.Ar rdr-to 1566and in the routing options of filter rules, but only for 1567.Ar least-states 1568and 1569.Ar round-robin 1570pools. 1571.Pp 1572Tables can be defined with any of the following 1573.Xr pfctl 8 1574mechanisms. 1575As with macros, reserved words may not be used as table names. 1576.Bl -tag -width "manually" 1577.It Ar manually 1578Persistent tables can be manually created with the 1579.Ar add 1580or 1581.Ar replace 1582option of 1583.Xr pfctl 8 , 1584before or after the ruleset has been loaded. 1585.It Pa pf.conf 1586Table definitions can be placed directly in this file and loaded at the 1587same time as other rules are loaded, atomically. 1588Table definitions inside 1589.Nm 1590use the 1591.Ar table 1592statement, and are especially useful to define non-persistent tables. 1593The contents of a pre-existing table defined without a list of addresses 1594to initialize it is not altered when 1595.Nm 1596is loaded. 1597A table initialized with the empty list, 1598.Li { } , 1599will be cleared on load. 1600.El 1601.Pp 1602Tables may be defined with the following attributes: 1603.Bl -tag -width persist 1604.It Ar const 1605The 1606.Ar const 1607flag prevents the user from altering the contents of the table once it 1608has been created. 1609Without that flag, 1610.Xr pfctl 8 1611can be used to add or remove addresses from the table at any time, even 1612when running with 1613.Xr securelevel 7 1614= 2. 1615.It Ar counters 1616The 1617.Ar counters 1618flag enables per-address packet and byte counters, which can be displayed with 1619.Xr pfctl 8 . 1620.It Ar persist 1621The 1622.Ar persist 1623flag forces the kernel to keep the table even when no rules refer to it. 1624If the flag is not set, the kernel will automatically remove the table 1625when the last rule referring to it is flushed. 1626.El 1627.Pp 1628This example 1629creates a table called private, 1630to hold RFC 1918 private network blocks, 1631and a table called badhosts, 1632which is initially empty. 1633A filter rule is set up to block all traffic coming from addresses listed in 1634either table: 1635.Bd -literal -offset indent 1636table \*(Ltprivate\*(Gt const { 10/8, 172.16/12, 192.168/16 } 1637table \*(Ltbadhosts\*(Gt persist 1638block on fxp0 from { \*(Ltprivate\*(Gt, \*(Ltbadhosts\*(Gt } to any 1639.Ed 1640.Pp 1641The private table cannot have its contents changed and the badhosts table 1642will exist even when no active filter rules reference it. 1643Addresses may later be added to the badhosts table, so that traffic from 1644these hosts can be blocked by using the following: 1645.Pp 1646.Dl # pfctl -t badhosts -Tadd 204.92.77.111 1647.Pp 1648A table can also be initialized with an address list specified in one or more 1649external files, using the following syntax: 1650.Bd -literal -offset indent 1651table \*(Ltspam\*(Gt persist file "/etc/spammers" file "/etc/openrelays" 1652block on fxp0 from \*(Ltspam\*(Gt to any 1653.Ed 1654.Pp 1655The files 1656.Pa /etc/spammers 1657and 1658.Pa /etc/openrelays 1659list IP addresses, one per line. 1660Any lines beginning with a 1661.Sq # 1662are treated as comments and ignored. 1663In addition to being specified by IP address, hosts may also be 1664specified by their hostname. 1665When the resolver is called to add a hostname to a table, 1666.Ar all 1667resulting IPv4 and IPv6 addresses are placed into the table. 1668IP addresses can also be entered in a table by specifying a valid interface 1669name, a valid interface group, or the 1670.Ar self 1671keyword, in which case all addresses assigned to the interface(s) will be 1672added to the table. 1673.Sh ANCHORS 1674Besides the main ruleset, 1675.Nm 1676can specify 1677.Ar anchor 1678attachment points. 1679An anchor is a container that can hold rules, 1680address tables, and other anchors. 1681When evaluation of the main ruleset reaches an 1682.Ar anchor 1683rule, 1684.Xr pf 4 1685will proceed to evaluate all rules specified in that anchor. 1686.Pp 1687The following example blocks all packets on the external interface by default, 1688then evaluates all rules in the anchor named "spam", 1689and finally passes all outgoing connections and 1690incoming connections to port 25: 1691.Bd -literal -offset indent 1692ext_if = "kue0" 1693block on $ext_if all 1694anchor spam 1695pass out on $ext_if all 1696pass in on $ext_if proto tcp from any to $ext_if port smtp 1697.Ed 1698.Pp 1699Anchors can be manipulated through 1700.Xr pfctl 8 1701without reloading the main ruleset or other anchors. 1702This loads a single rule into the anchor, 1703which blocks all packets from a specific address: 1704.Bd -literal -offset indent 1705# echo "block in quick from 1.2.3.4 to any" | pfctl -a spam -f - 1706.Ed 1707.Pp 1708The anchor can also be populated by adding a 1709.Ar load anchor 1710rule after the anchor rule. 1711When 1712.Xr pfctl 8 1713loads 1714.Nm , 1715it will also load all the rules from the file 1716.Pa /etc/pf-spam.conf 1717into the anchor. 1718.Bd -literal -offset indent 1719anchor spam 1720load anchor spam from "/etc/pf-spam.conf" 1721.Ed 1722.Pp 1723Filter rule anchors can also be loaded inline in the ruleset 1724within a brace-delimited block. 1725Brace delimited blocks may contain rules or other brace-delimited blocks. 1726When anchors are loaded this way the anchor name becomes optional. 1727Since the parser specification for anchor names is a string, 1728double quote characters 1729.Pq Sq \&" 1730should be placed around the anchor name. 1731.Bd -literal -offset indent 1732anchor "external" on egress { 1733 block 1734 anchor out { 1735 pass proto tcp from any to port { 25, 80, 443 } 1736 } 1737 pass in proto tcp to any port 22 1738} 1739.Ed 1740.Pp 1741Anchor rules can also specify packet filtering parameters 1742using the same syntax as filter rules. 1743When parameters are used, 1744the anchor rule is only evaluated for matching packets. 1745This allows conditional evaluation of anchors, like: 1746.Bd -literal -offset indent 1747block on $ext_if all 1748anchor spam proto tcp from any to any port smtp 1749pass out on $ext_if all 1750pass in on $ext_if proto tcp from any to $ext_if port smtp 1751.Ed 1752.Pp 1753The rules inside anchor "spam" are only evaluated 1754for TCP packets with destination port 25. 1755Hence, the following 1756will only block connections from 1.2.3.4 to port 25: 1757.Bd -literal -offset indent 1758# echo "block in quick from 1.2.3.4 to any" | pfctl -a spam -f - 1759.Ed 1760.Pp 1761Matching filter and translation rules marked with the 1762.Ar quick 1763option are final and abort the evaluation of the rules in other 1764anchors and the main ruleset. 1765If the anchor itself is marked with the 1766.Ar quick 1767option, 1768ruleset evaluation will terminate when the anchor is exited if the packet is 1769matched by any rule within the anchor. 1770.Pp 1771An anchor references other anchor attachment points 1772using the following syntax: 1773.Bl -tag -width xxxx 1774.It Ar anchor Aq Ar name 1775Evaluates the filter rules in the specified anchor. 1776.El 1777.Pp 1778An anchor has a name which specifies the path where 1779.Xr pfctl 8 1780can be used to access the anchor to perform operations on it, such as 1781attaching child anchors to it or loading rules into it. 1782Anchors may be nested, with components separated by 1783.Sq / 1784characters, similar to how file system hierarchies are laid out. 1785The main ruleset is actually the default anchor, so filter and 1786translation rules, for example, may also be contained in any anchor. 1787.Pp 1788Anchor rules are evaluated relative to the anchor in which they are contained. 1789For example, 1790all anchor rules specified in the main ruleset will reference 1791anchor attachment points underneath the main ruleset, 1792and anchor rules specified in a file loaded from a 1793.Ar load anchor 1794rule will be attached under that anchor point. 1795.Pp 1796Anchors may end with the asterisk 1797.Pq Sq * 1798character, which signifies that all anchors attached at that point 1799should be evaluated in the alphabetical ordering of their anchor name. 1800For example, 1801the following 1802will evaluate each rule in each anchor attached to the "spam" anchor: 1803.Bd -literal -offset indent 1804anchor "spam/*" 1805.Ed 1806.Pp 1807Note that it will only evaluate anchors that are directly attached to the 1808"spam" anchor, and will not descend to evaluate anchors recursively. 1809.Pp 1810Since anchors are evaluated relative to the anchor in which they are 1811contained, there is a mechanism for accessing the parent and ancestor 1812anchors of a given anchor. 1813Similar to file system path name resolution, if the sequence 1814.Sq .. 1815appears as an anchor path component, the parent anchor of the current 1816anchor in the path evaluation at that point will become the new current 1817anchor. 1818As an example, consider the following: 1819.Bd -literal -offset indent 1820# printf 'anchor "spam/allowed"\en' | pfctl -f - 1821# printf 'anchor "../banned"\enpass\en' | pfctl -a spam/allowed -f - 1822.Ed 1823.Pp 1824Evaluation of the main ruleset will lead into the 1825spam/allowed anchor, which will evaluate the rules in the 1826spam/banned anchor, if any, before finally evaluating the 1827.Ar pass 1828rule. 1829.Sh STATEFUL FILTERING 1830.Xr pf 4 1831filters packets statefully, 1832which has several advantages. 1833For TCP connections, comparing a packet to a state involves checking 1834its sequence numbers, as well as TCP timestamps if a rule using the 1835.Ar reassemble tcp 1836parameter applies to the connection. 1837If these values are outside the narrow windows of expected 1838values, the packet is dropped. 1839This prevents spoofing attacks, such as when an attacker sends packets with 1840a fake source address/port but does not know the connection's sequence 1841numbers. 1842Similarly, 1843.Xr pf 4 1844knows how to match ICMP replies to states. 1845For example, 1846to allow echo requests (such as those created by 1847.Xr ping 8 ) 1848out statefully and match incoming echo replies correctly to states: 1849.Pp 1850.Dl pass out inet proto icmp all icmp-type echoreq 1851.Pp 1852Also, looking up states is usually faster than evaluating rules. 1853If there are 50 rules, all of them are evaluated sequentially in O(n). 1854Even with 50000 states, only 16 comparisons are needed to match a 1855state, since states are stored in a binary search tree that allows 1856searches in O(log2 n). 1857.Pp 1858Furthermore, correct handling of ICMP error messages is critical to 1859many protocols, particularly TCP. 1860.Xr pf 4 1861matches ICMP error messages to the correct connection, checks them against 1862connection parameters, and passes them if appropriate. 1863For example if an ICMP source quench message referring to a stateful TCP 1864connection arrives, it will be matched to the state and get passed. 1865.Pp 1866Finally, state tracking is required for 1867.Ar nat-to 1868and 1869.Ar rdr-to 1870options, in order to track address and port translations and reverse the 1871translation on returning packets. 1872.Pp 1873.Xr pf 4 1874will also create state for other protocols which are effectively stateless by 1875nature. 1876UDP packets are matched to states using only host addresses and ports, 1877and other protocols are matched to states using only the host addresses. 1878.Pp 1879If stateless filtering of individual packets is desired, 1880the 1881.Ar no state 1882keyword can be used to specify that state will not be created 1883if this is the last matching rule. 1884Note that packets which match neither block nor pass rules, 1885and thus are passed by default, 1886are effectively passed as if 1887.Ar no state 1888had been specified. 1889.Pp 1890A number of parameters can also be set to affect how 1891.Xr pf 4 1892handles state tracking, 1893as detailed below. 1894.Ss State Modulation 1895Much of the security derived from TCP is attributable to how well the 1896initial sequence numbers (ISNs) are chosen. 1897Some popular stack implementations choose 1898.Em very 1899poor ISNs and thus are normally susceptible to ISN prediction exploits. 1900By applying a 1901.Ar modulate state 1902rule to a TCP connection, 1903.Xr pf 4 1904will create a high quality random sequence number for each connection 1905endpoint. 1906.Pp 1907The 1908.Ar modulate state 1909directive implicitly keeps state on the rule and is 1910only applicable to TCP connections. 1911.Pp 1912For instance: 1913.Bd -literal -offset indent 1914block all 1915pass out proto tcp from any to any modulate state 1916pass in proto tcp from any to any port 25 flags S/SFRA \e 1917 modulate state 1918.Ed 1919.Pp 1920Note that modulated connections will not recover when the state table 1921is lost (firewall reboot, flushing the state table, etc.). 1922.Xr pf 4 1923will not be able to infer a connection again after the state table flushes 1924the connection's modulator. 1925When the state is lost, the connection may be left dangling until the 1926respective endpoints time out the connection. 1927It is possible on a fast local network for the endpoints to start an ACK 1928storm while trying to resynchronize after the loss of the modulator. 1929The default 1930.Ar flags 1931settings (or a more strict equivalent) should be used on 1932.Ar modulate state 1933rules to prevent ACK storms. 1934.Pp 1935Note that alternative methods are available 1936to prevent loss of the state table 1937and allow for firewall failover. 1938See 1939.Xr carp 4 1940and 1941.Xr pfsync 4 1942for further information. 1943.Ss SYN Proxy 1944By default, 1945.Xr pf 4 1946passes packets that are part of a 1947TCP handshake between the endpoints. 1948The 1949.Ar synproxy state 1950option can be used to cause 1951.Xr pf 4 1952itself to complete the handshake with the active endpoint, perform a handshake 1953with the passive endpoint, and then forward packets between the endpoints. 1954.Pp 1955No packets are sent to the passive endpoint before the active endpoint has 1956completed the handshake, hence so-called SYN floods with spoofed source 1957addresses will not reach the passive endpoint, as the sender can't complete the 1958handshake. 1959.Pp 1960The proxy is transparent to both endpoints; they each see a single 1961connection from/to the other endpoint. 1962.Xr pf 4 1963chooses random initial sequence numbers for both handshakes. 1964Once the handshakes are completed, the sequence number modulators 1965(see previous section) are used to translate further packets of the 1966connection. 1967.Ar synproxy state 1968includes 1969.Ar modulate state . 1970.Pp 1971Rules with 1972.Ar synproxy 1973will not work if 1974.Xr pf 4 1975operates on a 1976.Xr bridge 4 . 1977.Pp 1978Example: 1979.Bd -literal -offset indent 1980pass in proto tcp from any to any port www synproxy state 1981.Ed 1982.Ss Stateful Tracking Options 1983A number of options related to stateful tracking can be applied on a 1984per-rule basis. 1985One of 1986.Ar keep state , 1987.Ar modulate state , 1988or 1989.Ar synproxy state 1990must be specified explicitly to apply these options to a rule. 1991.Pp 1992.Bl -tag -width xxxx -compact 1993.It Ar floating 1994States can match packets on any interfaces 1995(the opposite of 1996.Ar if-bound ) . 1997This is the default. 1998.It Ar if-bound 1999States are bound to an interface 2000(the opposite of 2001.Ar floating ) . 2002.It Ar max Aq Ar number 2003Limits the number of concurrent states the rule may create. 2004When this limit is reached, further packets that would create 2005state are dropped until existing states time out. 2006.It Ar no-sync 2007Prevent state changes for states created by this rule from appearing on the 2008.Xr pfsync 4 2009interface. 2010.It Ar pflow 2011States created by this rule are exported on the 2012.Xr pflow 4 2013interface. 2014.It Ar sloppy 2015Uses a sloppy TCP connection tracker that does not check sequence 2016numbers at all, which makes insertion and ICMP teardown attacks way 2017easier. 2018This is intended to be used in situations where one does not see all 2019packets of a connection, e.g. in asymmetric routing situations. 2020It cannot be used with 2021.Ar modulate 2022or 2023.Ar synproxy state . 2024.It Xo Aq Ar timeout 2025.Aq Ar seconds 2026.Xc 2027Changes the timeout values used for states created by this rule. 2028For a list of all valid timeout names, see 2029.Sx OPTIONS 2030above. 2031.El 2032.Pp 2033Multiple options can be specified, separated by commas: 2034.Bd -literal -offset indent 2035pass in proto tcp from any to any \e 2036 port www keep state \e 2037 (max 100, source-track rule, max-src-nodes 75, \e 2038 max-src-states 3, tcp.established 60, tcp.closing 5) 2039.Ed 2040.Pp 2041When the 2042.Ar source-track 2043keyword is specified, the number of states per source IP is tracked. 2044.Pp 2045.Bl -tag -width xxxx -compact 2046.It Ar source-track global 2047The number of states created by all rules that use this option is limited. 2048Each rule can specify different 2049.Ar max-src-nodes 2050and 2051.Ar max-src-states 2052options, however state entries created by any participating rule count towards 2053each individual rule's limits. 2054.It Ar source-track rule 2055The maximum number of states created by this rule is limited by the rule's 2056.Ar max-src-nodes 2057and 2058.Ar max-src-states 2059options. 2060Only state entries created by this particular rule count toward the rule's 2061limits. 2062.El 2063.Pp 2064The following limits can be set: 2065.Pp 2066.Bl -tag -width xxxx -compact 2067.It Ar max-src-nodes Aq Ar number 2068Limits the maximum number of source addresses which can simultaneously 2069have state table entries. 2070.It Ar max-src-states Aq Ar number 2071Limits the maximum number of simultaneous state entries that a single 2072source address can create with this rule. 2073.El 2074.Pp 2075For stateful TCP connections, limits on established connections (connections 2076which have completed the TCP 3-way handshake) can also be enforced 2077per source IP. 2078.Pp 2079.Bl -tag -width xxxx -compact 2080.It Ar max-src-conn Aq Ar number 2081Limits the maximum number of simultaneous TCP connections which have 2082completed the 3-way handshake that a single host can make. 2083.It Xo Ar max-src-conn-rate Aq Ar number 2084.No / Aq Ar seconds 2085.Xc 2086Limit the rate of new connections over a time interval. 2087The connection rate is an approximation calculated as a moving average. 2088.El 2089.Pp 2090When one of these limits is reached, further packets that would create 2091state are dropped until existing states time out. 2092.Pp 2093Because the 3-way handshake ensures that the source address is not being 2094spoofed, more aggressive action can be taken based on these limits. 2095With the 2096.Ar overload Aq Ar table 2097state option, source IP addresses which hit either of the limits on 2098established connections will be added to the named table. 2099This table can be used in the ruleset to block further activity from 2100the offending host, redirect it to a tarpit process, or restrict its 2101bandwidth. 2102.Pp 2103The optional 2104.Ar flush 2105keyword kills all states created by the matching rule which originate 2106from the host which exceeds these limits. 2107The 2108.Ar global 2109modifier to the flush command kills all states originating from the 2110offending host, regardless of which rule created the state. 2111.Pp 2112For example, the following rules will protect the webserver against 2113hosts making more than 100 connections in 10 seconds. 2114Any host which connects faster than this rate will have its address added 2115to the 2116.Aq bad_hosts 2117table and have all states originating from it flushed. 2118Any new packets arriving from this host will be dropped unconditionally 2119by the block rule. 2120.Bd -literal -offset indent 2121block quick from \*(Ltbad_hosts\*(Gt 2122pass in on $ext_if proto tcp to $webserver port www keep state \e 2123 (max-src-conn-rate 100/10, overload \*(Ltbad_hosts\*(Gt flush global) 2124.Ed 2125.Sh TRAFFIC NORMALISATION 2126Traffic normalisation is a broad umbrella term 2127for aspects of the packet filter which deal with 2128verifying packets, packet fragments, spoof traffic, 2129and other irregularities. 2130.Ss Scrub 2131Scrub involves sanitising packet content in such a way 2132that there are no ambiguities in packet interpretation on the receiving side. 2133It is invoked with the 2134.Ar scrub 2135option, added to regular rules. 2136.Pp 2137Parameters are specified enclosed in parentheses. 2138At least one of the following parameters must be specified: 2139.Bl -tag -width xxxx 2140.It Ar max-mss Aq Ar number 2141Enforces a maximum segment size (MSS) for matching TCP packets. 2142.It Ar min-ttl Aq Ar number 2143Enforces a minimum TTL for matching IP packets. 2144.It Ar no-df 2145Clears the 2146.Ar dont-fragment 2147bit from a matching IPv4 packet. 2148Some operating systems have NFS implementations 2149which are known to generate fragmented packets with the 2150.Ar dont-fragment 2151bit set. 2152.Xr pf 4 2153will drop such fragmented 2154.Ar dont-fragment 2155packets unless 2156.Ar no-df 2157is specified. 2158.Pp 2159Unfortunately some operating systems also generate their 2160.Ar dont-fragment 2161packets with a zero IP identification field. 2162Clearing the 2163.Ar dont-fragment 2164bit on packets with a zero IP ID may cause deleterious results if an 2165upstream router later fragments the packet. 2166Using 2167.Ar random-id 2168is recommended in combination with 2169.Ar no-df 2170to ensure unique IP identifiers. 2171.It Ar random-id 2172Replaces the IPv4 identification field with random values to compensate 2173for predictable values generated by many hosts. 2174This option only applies to packets that are not fragmented 2175after the optional fragment reassembly. 2176.It Ar reassemble tcp 2177Statefully normalises TCP connections. 2178.Ar reassemble tcp 2179performs the following normalisations: 2180.Bl -ohang 2181.It TTL 2182Neither side of the connection is allowed to reduce their IP TTL. 2183An attacker may send a packet such that it reaches the firewall, affects 2184the firewall state, and expires before reaching the destination host. 2185.Ar reassemble tcp 2186will raise the TTL of all packets back up to the highest value seen on 2187the connection. 2188.It Timestamp Modulation 2189Modern TCP stacks will send a timestamp on every TCP packet and echo 2190the other endpoint's timestamp back to them. 2191Many operating systems will merely start the timestamp at zero when 2192first booted, and increment it several times a second. 2193The uptime of the host can be deduced by reading the timestamp and multiplying 2194by a constant. 2195Also observing several different timestamps can be used to count hosts 2196behind a NAT device. 2197And spoofing TCP packets into a connection requires knowing or guessing 2198valid timestamps. 2199Timestamps merely need to be monotonically increasing and not derived off a 2200guessable base time. 2201.Ar reassemble tcp 2202will cause 2203.Ar scrub 2204to modulate the TCP timestamps with a random number. 2205.It Extended PAWS Checks 2206There is a problem with TCP on long fat pipes, in that a packet might get 2207delayed for longer than it takes the connection to wrap its 32-bit sequence 2208space. 2209In such an occurrence, the old packet would be indistinguishable from a 2210new packet and would be accepted as such. 2211The solution to this is called PAWS: Protection Against Wrapped Sequence 2212numbers. 2213It protects against it by making sure the timestamp on each packet does 2214not go backwards. 2215.Ar reassemble tcp 2216also makes sure the timestamp on the packet does not go forward more 2217than the RFC allows. 2218By doing this, 2219.Xr pf 4 2220artificially extends the security of TCP sequence numbers by 10 to 18 2221bits when the host uses appropriately randomized timestamps, since a 2222blind attacker would have to guess the timestamp as well. 2223.El 2224.El 2225.Pp 2226For example: 2227.Pp 2228.Dl match in all scrub (no-df random-id max-mss 1440) 2229.Ss Fragment Handling 2230The size of IP datagrams (packets) can be significantly larger than the 2231maximum transmission unit (MTU) of the network. 2232In cases when it is necessary or more efficient to send such large packets, 2233the large packet will be fragmented into many smaller packets that will each 2234fit onto the wire. 2235Unfortunately for a firewalling device, only the first logical fragment will 2236contain the necessary header information for the subprotocol that allows 2237.Xr pf 4 2238to filter on things such as TCP ports or to perform NAT. 2239.Pp 2240One alternative is to filter individual fragments with filter rules. 2241If packet reassembly is turned off, it is passed to the filter. 2242Filter rules with matching IP header parameters decide whether the 2243fragment is passed or blocked, in the same way as complete packets 2244are filtered. 2245Without reassembly, fragments can only be filtered based on IP header 2246fields (source/destination address, protocol), since subprotocol header 2247fields are not available (TCP/UDP port numbers, ICMP code/type). 2248The 2249.Ar fragment 2250option can be used to restrict filter rules to apply only to 2251fragments, but not complete packets. 2252Filter rules without the 2253.Ar fragment 2254option still apply to fragments, if they only specify IP header fields. 2255For instance: 2256.Bd -literal -offset indent 2257pass in proto tcp from any to any port 80 2258.Ed 2259.Pp 2260The rule above never applies to a fragment, 2261even if the fragment is part of a TCP packet with destination port 80, 2262because without reassembly this information 2263is not available for each fragment. 2264This also means that fragments cannot create new or match existing 2265state table entries, which makes stateful filtering and address 2266translation (NAT, redirection) for fragments impossible. 2267.Pp 2268In most cases, the benefits of reassembly outweigh the additional 2269memory cost, 2270so reassembly is on by default. 2271.Pp 2272The memory allocated for fragment caching can be limited using 2273.Xr pfctl 8 . 2274Once this limit is reached, fragments that would have to be cached 2275are dropped until other entries time out. 2276The timeout value can also be adjusted. 2277.Pp 2278When forwarding reassembled IPv6 packets, pf refragments them with 2279the original maximum fragment size. 2280This allows the sender to determine the optimal fragment size by 2281path MTU discovery. 2282.Ss Blocking Spoofed Traffic 2283Spoofing is the faking of IP addresses, 2284typically for malicious purposes. 2285The 2286.Ar antispoof 2287directive expands to a set of filter rules which will block all 2288traffic with a source IP from the network(s) directly connected 2289to the specified interface(s) from entering the system through 2290any other interface. 2291.Pp 2292For example: 2293.Dl antispoof for lo0 2294.Pp 2295Expands to: 2296.Bd -literal -offset indent -compact 2297block drop in on ! lo0 inet from 127.0.0.1/8 to any 2298block drop in on ! lo0 inet6 from ::1 to any 2299.Ed 2300.Pp 2301For non-loopback interfaces, there are additional rules to block incoming 2302packets with a source IP address identical to the interface's IP(s). 2303For example, assuming the interface wi0 had an IP address of 10.0.0.1 and a 2304netmask of 255.255.255.0: 2305.Pp 2306.Dl antispoof for wi0 inet 2307.Pp 2308Expands to: 2309.Bd -literal -offset indent -compact 2310block drop in on ! wi0 inet from 10.0.0.0/24 to any 2311block drop in inet from 10.0.0.1 to any 2312.Ed 2313.Pp 2314Caveat: Rules created by the 2315.Ar antispoof 2316directive interfere with packets sent over loopback interfaces 2317to local addresses. 2318One should pass these explicitly. 2319.Sh OPERATING SYSTEM FINGERPRINTING 2320Passive OS fingerprinting is a mechanism to inspect nuances of a TCP 2321connection's initial SYN packet and guess at the host's operating system. 2322Unfortunately these nuances are easily spoofed by an attacker so the 2323fingerprint is not useful in making security decisions. 2324But the fingerprint is typically accurate enough to make policy decisions 2325upon. 2326.Pp 2327The fingerprints may be specified by operating system class, by 2328version, or by subtype/patchlevel. 2329The class of an operating system is typically the vendor or genre 2330and would be 2331.Ox 2332for the 2333.Xr pf 4 2334firewall itself. 2335The version of the oldest available 2336.Ox 2337release on the main FTP site 2338would be 2.6 and the fingerprint would be written as: 2339.Pp 2340.Dl \&"OpenBSD 2.6\&" 2341.Pp 2342The subtype of an operating system is typically used to describe the 2343patchlevel if that patch led to changes in the TCP stack behavior. 2344In the case of 2345.Ox , 2346the only subtype is for a fingerprint that was 2347normalised by the 2348.Ar no-df 2349scrub option and would be specified as: 2350.Pp 2351.Dl \&"OpenBSD 3.3 no-df\&" 2352.Pp 2353Fingerprints for most popular operating systems are provided by 2354.Xr pf.os 5 . 2355Once 2356.Xr pf 4 2357is running, a complete list of known operating system fingerprints may 2358be listed by running: 2359.Pp 2360.Dl # pfctl -so 2361.Pp 2362Filter rules can enforce policy at any level of operating system specification 2363assuming a fingerprint is present. 2364Policy could limit traffic to approved operating systems or even ban traffic 2365from hosts that aren't at the latest service pack. 2366.Pp 2367The 2368.Ar unknown 2369class can also be used as the fingerprint which will match packets for 2370which no operating system fingerprint is known. 2371.Pp 2372Examples: 2373.Bd -literal -offset indent 2374pass out proto tcp from any os OpenBSD 2375block out proto tcp from any os Doors 2376block out proto tcp from any os "Doors PT" 2377block out proto tcp from any os "Doors PT SP3" 2378block out from any os "unknown" 2379pass on lo0 proto tcp from any os "OpenBSD 3.3 lo0" 2380.Ed 2381.Pp 2382Operating system fingerprinting is limited only to the TCP SYN packet. 2383This means that it will not work on other protocols and will not match 2384a currently established connection. 2385.Pp 2386Caveat: operating system fingerprints are occasionally wrong. 2387There are three problems: an attacker can trivially craft his packets to 2388appear as any operating system he chooses; 2389an operating system patch could change the stack behavior and no fingerprints 2390will match it until the database is updated; 2391and multiple operating systems may have the same fingerprint. 2392.Sh EXAMPLES 2393In this example, 2394the external interface is kue0. 2395We use a macro for the interface name, so it can be changed easily. 2396All incoming traffic is "normalised", 2397and everything is blocked and logged by default. 2398.Bd -literal -offset 4n 2399ext_if = "kue0" 2400match in all scrub (no-df max-mss 1440) 2401block return log on $ext_if all 2402.Ed 2403.Pp 2404Here we specifically block packets we don't want: 2405anything coming from source we have no back routes for; 2406packets whose ingress interface does not match the one in 2407the route back to their source address; 2408anything that does not have our address (157.161.48.183) as source; 2409broadcasts (cable modem noise); 2410and anything from reserved address space or invalid addresses. 2411.Bd -literal -offset 4n 2412block in from no-route to any 2413block in from urpf-failed to any 2414block out log quick on $ext_if from ! 157.161.48.183 to any 2415block in quick on $ext_if from any to 255.255.255.255 2416block in log quick on $ext_if from { 10.0.0.0/8, 172.16.0.0/12, \e 2417 192.168.0.0/16, 255.255.255.255/32 } to any 2418.Ed 2419.Pp 2420For ICMP, 2421pass out/in ping queries. 2422State matching is done on host addresses and ICMP ID (not type/code), 2423so replies (like 0/0 for 8/0) will match queries. 2424ICMP error messages (which always refer to a TCP/UDP packet) 2425are handled by the TCP/UDP states. 2426.Bd -literal -offset 4n 2427pass on $ext_if inet proto icmp all icmp-type 8 code 0 2428.Ed 2429.Pp 2430For UDP, 2431pass out all UDP connections. 2432DNS connections are passed in. 2433.Bd -literal -offset 4n 2434pass out on $ext_if proto udp all 2435pass in on $ext_if proto udp from any to any port domain 2436.Ed 2437.Pp 2438For TCP, 2439pass out all TCP connections and modulate state. 2440SSH, SMTP, DNS, and IDENT connections are passed in. 2441We do not allow Windows 9x SMTP connections since they are typically 2442a viral worm. 2443.Bd -literal -offset 4n 2444pass out on $ext_if proto tcp all modulate state 2445pass in on $ext_if proto tcp from any to any \e 2446 port { ssh, smtp, domain, auth } 2447block in on $ext_if proto tcp from any \e 2448 os { "Windows 95", "Windows 98" } to any port smtp 2449.Ed 2450.Pp 2451Here we pass in/out all IPv6 traffic: 2452note that we have to enable this in two different ways, 2453on both our physical interface and our tunnel. 2454.Bd -literal -offset 4n 2455pass quick on gif0 inet6 2456pass quick on $ext_if proto ipv6 2457.Ed 2458.Pp 2459This example illustrates packet tagging. 2460There are three interfaces: $int_if, $ext_if, and $wifi_if (wireless). 2461NAT is being done on $ext_if for all outgoing packets. 2462Packets in on $int_if are tagged and passed out on $ext_if. 2463All other outgoing packets 2464(i.e. packets from the wireless network) 2465are only permitted to access port 80. 2466.Bd -literal -offset 4n 2467pass in on $int_if from any to any tag INTNET 2468pass in on $wifi_if from any to any 2469 2470block out on $ext_if from any to any 2471pass out quick on $ext_if tagged INTNET 2472pass out on $ext_if proto tcp from any to any port 80 2473.Ed 2474.Pp 2475In this example, 2476we tag incoming packets as they are redirected to spamd(8). 2477The tag is used to pass those packets through the packet filter. 2478.Bd -literal -offset 4n 2479match in on $ext_if inet proto tcp from \*(Ltspammers\*(Gt to port smtp \e 2480 tag SPAMD rdr-to 127.0.0.1 port spamd 2481 2482block in on $ext_if 2483pass in on $ext_if inet proto tcp tagged SPAMD 2484.Ed 2485.Pp 2486This example maps incoming requests on port 80 to port 8080, on 2487which a daemon is running (because, for example, it is not run as root, 2488and therefore lacks permission to bind to port 80). 2489.Bd -literal -offset 4n 2490match in on $ext_if proto tcp from any to any port 80 \e 2491 rdr-to 127.0.0.1 port 8080 2492.Ed 2493.Pp 2494If a 2495.Ar pass 2496rule is used with the 2497.Ar quick 2498modifier, packets matching the translation rule are passed without 2499inspecting subsequent filter rules. 2500.Bd -literal -offset 4n 2501pass in quick on $ext_if proto tcp from any to any port 80 \e 2502 rdr-to 127.0.0.1 port 8080 2503.Ed 2504.Pp 2505In the example below, vlan12 is configured as 192.168.168.1; 2506the machine translates all packets coming from 192.168.168.0/24 to 204.92.77.111 2507when they are going out any interface except vlan12. 2508This has the net effect of making traffic from the 192.168.168.0/24 2509network appear as though it is the Internet routable address 2510204.92.77.111 to nodes behind any interface on the router except 2511for the nodes on vlan12. 2512Thus, 192.168.168.1 can talk to the 192.168.168.0/24 nodes. 2513.Bd -literal -offset 4n 2514match out on ! vlan12 from 192.168.168.0/24 to any nat-to 204.92.77.111 2515.Ed 2516.Pp 2517In the example below, the machine sits between a fake internal 2518144.19.74.* network, and a routable external IP of 204.92.77.100. 2519The last rule excludes protocol AH from being translated. 2520.Bd -literal -offset 4n 2521pass out on $ext_if from 144.19.74.0/24 nat-to 204.92.77.100 2522pass out on $ext_if proto ah from 144.19.74.0/24 2523.Ed 2524.Pp 2525In the example below, packets bound for one specific server, as well as those 2526generated by the sysadmins are not proxied; all other connections are. 2527.Bd -literal -offset 4n 2528pass in on $int_if proto { tcp, udp } from any to any port 80 \e 2529 rdr-to 127.0.0.1 port 80 2530pass in on $int_if proto { tcp, udp } from any to $server port 80 2531pass in on $int_if proto { tcp, udp } from $sysadmins to any port 80 2532.Ed 2533.Pp 2534This example maps outgoing packets' source port 2535to an assigned proxy port instead of an arbitrary port. 2536In this case, proxy outgoing isakmp with port 500 on the gateway. 2537.Bd -literal -offset 4n 2538match out on $ext_if inet proto udp from any port isakmp to any \e 2539 nat-to ($ext_if) port 500 2540.Ed 2541.Pp 2542One more example uses 2543.Ar rdr-to 2544to redirect a TCP and UDP port to an internal machine. 2545.Bd -literal -offset 4n 2546match in on $ext_if inet proto tcp from any to ($ext_if) port 8080 \e 2547 rdr-to 10.1.2.151 port 22 2548match in on $ext_if inet proto udp from any to ($ext_if) port 8080 \e 2549 rdr-to 10.1.2.151 port 53 2550.Ed 2551.Pp 2552In this example, a NAT gateway is set up to translate internal addresses 2553using a pool of public addresses (192.0.2.16/28). 2554A given source address is always translated to the same pool address by 2555using the source-hash keyword. 2556The gateway also translates incoming web server connections 2557to a group of web servers on the internal network. 2558.Bd -literal -offset 4n 2559match out on $ext_if inet from any to any nat-to 192.0.2.16/28 \e 2560 source-hash 2561match in on $ext_if proto tcp from any to any port 80 \e 2562 rdr-to { 10.1.2.155 weight 2, 10.1.2.160 weight 1, \e 2563 10.1.2.161 weight 8 } round-robin 2564.Ed 2565.Pp 2566The bidirectional address translation example uses a single 2567.Ar binat-to 2568rule that expands to a 2569.Ar nat-to 2570and an 2571.Ar rdr-to 2572rule. 2573.Bd -literal -offset 4n 2574pass on $ext_if from 10.1.2.120 to any binat-to 192.0.2.17 2575.Ed 2576.Pp 2577The previous example is identical to the following set of rules: 2578.Bd -literal -offset 4n 2579pass out on $ext_if inet from 10.1.2.120 to any \e 2580 nat-to 192.0.2.17 static-port 2581pass in on $ext_if inet from any to 192.0.2.17 rdr-to 10.1.2.120 2582.Ed 2583.Pp 2584In the example below, a router handling both address families 2585translates an internal IPv4 subnet to IPv6 using the well-known 258664:ff9b::/96 prefix: 2587.Bd -literal -offset 4n 2588pass in on $v4_if inet af-to inet6 from ($v6_if) to 64:ff9b::/96 2589.Ed 2590.Pp 2591Paired with the example above, the example below can be used on 2592another router handling both address families to translate back 2593to IPv4: 2594.Bd -literal -offset 4n 2595pass in on $v6_if inet6 to 64:ff9b::/96 af-to inet from ($v4_if) 2596.Ed 2597.Sh GRAMMAR 2598Syntax for 2599.Nm 2600in BNF: 2601.Bd -literal 2602line = ( option | pf-rule | 2603 antispoof-rule | queue-rule | anchor-rule | 2604 anchor-close | load-anchor | table-rule | include ) 2605 2606option = "set" ( [ "timeout" ( timeout | "{" timeout-list "}" ) ] | 2607 [ "ruleset-optimization" [ "none" | "basic" | 2608 "profile" ] ] | 2609 [ "optimization" [ "default" | "normal" | "high-latency" | 2610 "satellite" | "aggressive" | "conservative" ] ] 2611 [ "limit" ( limit-item | "{" limit-list "}" ) ] | 2612 [ "loginterface" ( interface-name | "none" ) ] | 2613 [ "block-policy" ( "drop" | "return" ) ] | 2614 [ "state-policy" ( "if-bound" | "floating" ) ] 2615 [ "state-defaults" state-opts ] 2616 [ "fingerprints" filename ] | 2617 [ "skip on" ifspec ] | 2618 [ "debug" ( "none" | "urgent" | "misc" | "loud" ) ] | 2619 [ "reassemble" ( "yes" | "no" ) [ "no-df" ] ] ) 2620 2621pf-rule = action [ ( "in" | "out" ) ] 2622 [ "log" [ "(" logopts ")"] ] [ "quick" ] 2623 [ "on" ( ifspec | "rdomain" number ) ] [ af ] 2624 [ protospec ] hosts [ filteropts ] 2625 2626logopts = logopt [ [ "," ] logopts ] 2627logopt = "all" | "matches" | "user" | "to" interface-name 2628 2629filteropts = filteropt [ [ "," ] filteropts ] 2630filteropt = user | group | flags | icmp-type | icmp6-type | 2631 "tos" tos | 2632 ( "no" | "keep" | "modulate" | "synproxy" ) "state" 2633 [ "(" state-opts ")" ] | "scrub" "(" scrubopts ")" | 2634 "fragment" | "allow-opts" | "once" | 2635 "divert-packet" "port" port | "divert-reply" | 2636 "divert-to" host "port" port | 2637 "label" string | "tag" string | [ ! ] "tagged" string | 2638 "set prio" ( number | "(" number [ [ "," ] number ] ")" ) | 2639 "set queue" ( string | "(" string [ [ "," ] string ] ")" ) | 2640 "rtable" number | "probability" number"%" | 2641 "af-to" af "from" ( redirhost | "{" redirhost-list "}" ) 2642 [ "to" ( redirhost | "{" redirhost-list "}" ) ] | 2643 "binat-to" ( redirhost | "{" redirhost-list "}" ) 2644 [ portspec ] [ pooltype ] | 2645 "rdr-to" ( redirhost | "{" redirhost-list "}" ) 2646 [ portspec ] [ pooltype ] | 2647 "nat-to" ( redirhost | "{" redirhost-list "}" ) 2648 [ portspec ] [ pooltype ] [ "static-port" ] | 2649 [ route ] | [ "set tos" tos ] | 2650 [ [ "!" ] "received-on" ( interface-name | interface-group ) ] 2651 2652scrubopts = scrubopt [ [ "," ] scrubopts ] 2653scrubopt = "no-df" | "min-ttl" number | "max-mss" number | 2654 "reassemble tcp" | "random-id" 2655 2656antispoof-rule = "antispoof" [ "log" ] [ "quick" ] 2657 "for" ifspec [ af ] [ "label" string ] 2658 2659table-rule = "table" "\*(Lt" string "\*(Gt" [ tableopts ] 2660tableopts = tableopt [ tableopts ] 2661tableopt = "persist" | "const" | "counters" | 2662 "file" string | "{" [ tableaddrs ] "}" 2663tableaddrs = tableaddr-spec [ [ "," ] tableaddrs ] 2664tableaddr-spec = [ "!" ] tableaddr [ "/" mask-bits ] 2665tableaddr = hostname | ifspec | "self" | 2666 ipv4-dotted-quad | ipv6-coloned-hex 2667 2668queue-rule = "queue" string [ "on" interface-name ] queueopts-list 2669 2670anchor-rule = "anchor" [ string ] [ ( "in" | "out" ) ] [ "on" ifspec ] 2671 [ af ] [ protospec ] [ hosts ] [ filteropt-list ] [ "{" ] 2672 2673anchor-close = "}" 2674 2675load-anchor = "load anchor" string "from" filename 2676 2677queueopts-list = queueopts-list queueopts | queueopts 2678queueopts = [ "bandwidth" bandwidth ] | [ "min" bandwidth ] | 2679 [ "max" bandwidth ] | [ "parent" string ] | 2680 [ "default" ] | [ "qlimit" number ] 2681bandwidth = bandwidth-spec [ "burst" bandwidth-spec "for" number "ms" ] 2682bandwidth-spec = number ( "" | "K" | "M" | "G" ) 2683 2684action = "pass" | "match" | "block" [ return ] 2685return = "drop" | "return" | 2686 "return-rst" [ "(" "ttl" number ")" ] | 2687 "return-icmp" [ "(" icmpcode [ [ "," ] icmp6code ] ")" ] | 2688 "return-icmp6" [ "(" icmp6code ")" ] 2689icmpcode = ( icmp-code-name | icmp-code-number ) 2690icmp6code = ( icmp6-code-name | icmp6-code-number ) 2691 2692ifspec = ( [ "!" ] ( interface-name | interface-group ) ) | 2693 "{" interface-list "}" 2694interface-list = [ "!" ] ( interface-name | interface-group ) 2695 [ [ "," ] interface-list ] 2696route = ( "route-to" | "reply-to" | "dup-to" ) 2697 ( routehost | "{" routehost-list "}" ) 2698 [ pooltype ] 2699af = "inet" | "inet6" 2700 2701protospec = "proto" ( proto-name | proto-number | 2702 "{" proto-list "}" ) 2703proto-list = ( proto-name | proto-number ) [ [ "," ] proto-list ] 2704 2705hosts = "all" | 2706 "from" ( "any" | "no-route" | "urpf-failed" | "self" | 2707 host | "{" host-list "}" | "route" string ) [ port ] 2708 [ os ] 2709 "to" ( "any" | "no-route" | "self" | host | 2710 "{" host-list "}" | "route" string ) [ port ] 2711 2712ipspec = "any" | host | "{" host-list "}" 2713host = [ "!" ] ( address [ "weight" number ] | 2714 address [ "/" mask-bits ] [ "weight" number ] | 2715 "\*(Lt" string "\*(Gt" ) 2716redirhost = address [ "/" mask-bits ] 2717routehost = host | host "@" interface-name | 2718 "(" interface-name [ address [ "/" mask-bits ] ] ")" 2719address = ( interface-name | interface-group | 2720 "(" ( interface-name | interface-group ) ")" | 2721 hostname | ipv4-dotted-quad | ipv6-coloned-hex ) 2722host-list = host [ [ "," ] host-list ] 2723redirhost-list = redirhost [ [ "," ] redirhost-list ] 2724routehost-list = routehost [ [ "," ] routehost-list ] 2725 2726port = "port" ( unary-op | binary-op | "{" op-list "}" ) 2727portspec = "port" ( number | name ) [ ":" ( "*" | number | name ) ] 2728os = "os" ( os-name | "{" os-list "}" ) 2729user = "user" ( unary-op | binary-op | "{" op-list "}" ) 2730group = "group" ( unary-op | binary-op | "{" op-list "}" ) 2731 2732unary-op = [ "=" | "!=" | "\*(Lt" | "\*(Le" | "\*(Gt" | "\*(Ge" ] 2733 ( name | number ) 2734binary-op = number ( "\*(Lt\*(Gt" | "\*(Gt\*(Lt" | ":" ) number 2735op-list = ( unary-op | binary-op ) [ [ "," ] op-list ] 2736 2737os-name = operating-system-name 2738os-list = os-name [ [ "," ] os-list ] 2739 2740flags = "flags" ( [ flag-set ] "/" flag-set | "any" ) 2741flag-set = [ "F" ] [ "S" ] [ "R" ] [ "P" ] [ "A" ] [ "U" ] [ "E" ] 2742 [ "W" ] 2743 2744icmp-type = "icmp-type" ( icmp-type-code | "{" icmp-list "}" ) 2745icmp6-type = "icmp6-type" ( icmp-type-code | "{" icmp-list "}" ) 2746icmp-type-code = ( icmp-type-name | icmp-type-number ) 2747 [ "code" ( icmp-code-name | icmp-code-number ) ] 2748icmp-list = icmp-type-code [ [ "," ] icmp-list ] 2749 2750tos = ( "lowdelay" | "throughput" | "reliability" | 2751 [ "0x" ] number ) 2752 2753state-opts = state-opt [ [ "," ] state-opts ] 2754state-opt = ( "max" number | "no-sync" | timeout | "sloppy" | 2755 "pflow" | "source-track" [ ( "rule" | "global" ) ] | 2756 "max-src-nodes" number | "max-src-states" number | 2757 "max-src-conn" number | 2758 "max-src-conn-rate" number "/" number | 2759 "overload" "\*(Lt" string "\*(Gt" [ "flush" [ "global" ] ] | 2760 "if-bound" | "floating" ) 2761 2762timeout-list = timeout [ [ "," ] timeout-list ] 2763timeout = ( "tcp.first" | "tcp.opening" | "tcp.established" | 2764 "tcp.closing" | "tcp.finwait" | "tcp.closed" | 2765 "udp.first" | "udp.single" | "udp.multiple" | 2766 "icmp.first" | "icmp.error" | 2767 "other.first" | "other.single" | "other.multiple" | 2768 "frag" | "interval" | "src.track" | 2769 "adaptive.start" | "adaptive.end" ) number 2770 2771limit-list = limit-item [ [ "," ] limit-list ] 2772limit-item = ( "states" | "frags" | "src-nodes" | "tables" | 2773 "table-entries" ) number 2774 2775pooltype = ( "bitmask" | "least-states" | 2776 "random" | "round-robin" | 2777 "source-hash" [ ( hex-key | string-key ) ] ) 2778 [ sticky-address ] 2779 2780include = "include" filename 2781.Ed 2782.Sh FILES 2783.Bl -tag -width "/etc/protocolsXXX" -compact 2784.It Pa /etc/hosts 2785Host name database. 2786.It Pa /etc/pf.conf 2787Default location of the ruleset file. 2788.It Pa /etc/pf.os 2789Default location of OS fingerprints. 2790.It Pa /etc/protocols 2791Protocol name database. 2792.It Pa /etc/services 2793Service name database. 2794.El 2795.Sh SEE ALSO 2796.Xr pf 4 , 2797.Xr pflow 4 , 2798.Xr pfsync 4 , 2799.Xr pf.os 5 , 2800.Xr pfctl 8 , 2801.Xr pflogd 8 2802.Sh HISTORY 2803The 2804.Nm 2805file format first appeared in 2806.Ox 3.0 . 2807