Packet Filter

Packet Filter setup

Of course IP Forwarding must be on in /etc/sysctl.conf:
And turned on PF in /etc/rc.conf:
PF operates by the last-match-wins method

The pfctl command

Use 'pfctl -R -f file' to load a rules file
Use 'pfctl -e' to enable the firewall rules
Use 'pfctl -d' to disable the firewall rules
Use 'pfctl -F rules' to flush the active ruleset
Use 'pfctl -s rules' to show the active ruleset
Use 'pfctl -s info' to show some statistics

PF - Logging

Packets are logged if they match a rule that specifies logging
Logged packets are sent to the /dev/pflog0 interface
The 'pflogd' daemon monitors the pflog0 interface

PF - Syntax

Best described by the BNF given in the pf.conf(5) manpage
Each rule is one of several Actions
Timing options
Statistics logging
Resource limits
Optimization
Packet scrubbing
Nat rules
Filter rules - pass or block
blocking rules may be optionally modified by a <return> clause:
Logging may be specified using the 'log' keyword
The 'quick' keyword short-circuits last-match-wins behavior
The rule may be applied to a specific interface
The rule may match only a specific ``address family''
So far, the syntax looks something like this:
The remaining clauses look like this:
<proto> clause used to match specific IP protocol types
IP Protocols may be specified by name or by number
The <hosts> clause looks like this:
<host> specifications may be:
<port> specifications express a RANGE of Port numbers
Binary <port> specifications - cont.
The <flags> clause only applies to TCP packets
The basic syntax of the <flags> clause is:
The <icmp> clause only applies to ICMP packets
Stateful Inspection is turned on using the <state> clause
The <misc> clause comprises several optional items

One final feature: macros

Macros are just variables

Constructing a firewall

The first rules express your default policy
Here is an important outgoing, stateful, rule:
Be sure to block bogus incoming source IP addrs:
Now add holes in the firewall to allow certain services
Here is an ICMP rule:
Here is a UDP rule:
And finally, here is a TCP rule:

Optimization

PF parser will SKIP unnecessary rules when matching

Packet Filter

PF is the new OpenBSD native firewall utility

PF is an IP firewall in that it operates on TCP/IP packets by looking at values in the network layer (IP) and transport layer (e.g. TCP) headers of each packet. Decisions about the fate of each packet are made based on matching the header values with specific rules that allow or deny the packets.

It is very similar to IPfilter except no Rule Grouping or Packet Dup'ing
See the IPfilter package for more information. It can be found at http://coombs.anu.edu.au/~avalon/ip-filter.html

Configure with the /etc/pf.conf file

Control and view with 'pfctl' command

Great References:

Manual Pages: pfctl(8) pf.conf(5) pflogd(8)
FAQ: http://www.openbsd.org/faq/faq6.html#PF
http://www.deadly.org/pf-howto/html/pf-howto.html

Packet Filter setup

Of course IP Forwarding must be on in /etc/sysctl.conf:

    net.inet.ip.forwarding=1

And turned on PF in /etc/rc.conf:

    pf=YES

PF operates by the last-match-wins method

Firewalling falls into two main categories with respect to how they treat their rulesets. One method is first match wins, in which the first rule that matches a given IP packet will determine that packets fate. last match wins firewalling has quite naturally the exact opposite behavior where the last rule to match the packet will determine its fate.

The pfctl command

Use 'pfctl -R -f file' to load a rules file

   % sudo pfctl -R -f /etc/pf.conf

   % sudo pfctl -F r

Use 'pfctl -s rules' to show the active ruleset

Use 'pfctl -s info' to show some statistics

PF - Logging

Packets are logged if they match a rule that specifies logging

Logged packets are sent to the /dev/pflog0 interface

Use 'tcpdump' on this interface for real-time log viewing
```
    % sudo tcpdump -n -ttt -i pflog0
```

The 'pflogd' daemon monitors the pflog0 interface

Logged packets then get written to /var/log/pflog

Use 'tcpdump' to view this file

    % sudo tcpdump -n -ttt -r /var/log/pflog | more

PF - Syntax

Best described by the BNF given in the pf.conf(5) manpage

Check it out, it is really quite short!

Each rule is one of several Actions

Note that the rules must also appear in the following order if they appear.

option - global settings
scrub - does things like packet defragmentation
nat - rule pertaining to NAT
filter - a pass or block firewall rule

Timing options

These options control various protocol timeout values Examples from the manual page:

  set timeout tcp.established 3600
  set timeout { tcp.opening 30, tcp.closing 900 }

Statistics logging

You can turn on statistics logging per network interface. Statistics include packet and byte counts.

  set loginterface dc0

Resource limits

Set limits on memory usage for session state information or fragment re-assembly. Example:

  set limit { states 20000, frags 20000 }

Optimization

The various optimization values change how quickly sessions timeout from the state table.

  set optimization aggressive

Packet scrubbing

Reassembles fragment IP packets
There are a number of possible ways to modify how scrub re-assembles packets. Please see the manual page for exact details.
Removes all IP options
There is some ambiguity about this behavior in the documentation. It is not clear if IP options are always blocked (whether you use 'scrub' or not) or if it is indeed use of 'scrub' that enables it.. There is also an allow-opts clause that may be used on filter rules to actually let packets with IP options through your firewall.
```
  scrub in all
```
The example would turn packet scrubbing on for packets received on all interfaces.

Nat rules

See http://bio3d.colorado.edu/tor/sadocs/tcpip/nat.html

Filter rules - pass or block

Each rule operates on a single traffic direction WRT an interface
- Either 'in' or 'out'
  Two rules would be needed to cover both directions..

blocking rules may be optionally modified by a <return> clause:

     return-rst     for TCP connections

     return-icmp    an ICMP UNREACHABLE by default

Logging may be specified using the 'log' keyword

The 'log-all' keyword may be used with Stateful connections
- By default only the first packet will logged
Remember that logging is specified on a per-rule basis
multiple matches mean multiple log entries.

The 'quick' keyword short-circuits last-match-wins behavior

If a quick rule matches, no further rules are processed
If every rule has the quick keyword, PF becomes a pure first-match-wins firewall

The rule may be applied to a specific interface

    on <intfc>      e.g.  on fxp0

If no interface is specified the rule gets applied to ALL interfaces

The rule may match only a specific ``address family''

Current address families are 'inet' and 'inet6'
By default all families will match

So far, the syntax looks something like this:

   <action>  <dir>  <log>  <quick>  <interface>  <af>

The latter four clauses are all optional

The remaining clauses look like this:

 ..  <proto>  <hosts>  <flags>  <icmp>  <state>  <misc>

<hosts> is the only mandatory clause

<proto> clause used to match specific IP protocol types

To specify a single protocol:
```
      proto tcp
```
To specify a list of protocols:
```
      proto { tcp, udp }
```

IP Protocols may be specified by name or by number

See the /etc/protocols file for name to number mappings

The <hosts> clause looks like this:

   from <host> port <port>   to <host> port <port>

The 'port <port>' are only used if TCP or UDP protocols have been specified
Both <host> and <port> specs may appear in Curly Brace lists:
```
 { <host>, <host> }
```

<host> specifications may be:

The 'any' keyword is short-hand for ``any IP address''
The 'all' keyword is short-hand for ``from any to any''
An IP address (or hostname)
A CIDR-notated subnet
An interface name (meaning that interface's IP address)
A '!' negated IP address, CIDR subnet or interface name

<port> specifications express a RANGE of Port numbers

UNARY specifications look like: <op> <N>
```
 <op> may be: = != < <= > >=
```
- Unary specification port numbers may be given by number or by name
- See the /etc/services file for name to number mappings
BINARY specifications look like: <N> <bop> <M>
```
 <bop> may be: <> or ><
```

Binary <port> specifications - cont.

    port  N  ><  M

Describes all ports greater than N but less than M
Doesn't include N or M, just the numbers between
```
 port N <> M
```
Called an 'except range'
Describes all ports less than N and all ports greater than M
Doesn't include N or M

The <flags> clause only applies to TCP packets

The basic syntax of the <flags> clause is:

    flags  <a>/<b>

<a> and are sets of TCP Flags expressed as a string
```
 e.g. F or SA or FSRPAU
```
If <a> is not specified it defaults to ``no flags''
If '/' is not specified it defaults to ``FSRPAU''
```
 flags <a>/
```
TCP packets match IF (and only if):
- All of the Flags in <a> are turned ON in the packet header
- AND those Flags in that are not in <a> are turned OFF in the packet header
Only the flag(s) in <a> can (and must) be turned ON: flags <a>
None of the flag(s) in can be turned ON: flags /

The <icmp> clause only applies to ICMP packets

ICMP packets may be matched by ICMP Type
- Specify Types by name or by number
- See /usr/include/netinet/ip_icmp.h for numbers
```
 icmp-type <type>
```
They may be matched by Type and Code
```
 icmp-type <type> code <code>
```
Either may be expressed in Curly-Brace lists

Stateful Inspection is turned on using the <state> clause

There are two possibilities:
```
     keep-state
```
```
     modulate-state
```
The modulate-state version randomizes initial TCP sequence numbers
- Use it for windoze boxes
- OpenBSD already randomizes initial TCP sequence numbers

The <misc> clause comprises several optional items

'allow-opts' is used to allow IP options in a packet
- By default, packets with IP options set are blocked
'no-df' is used to explicitely turn OFF the dont-fragment bit
- Used with the 'scrub' action
'min-ttl <N>' causes the TTL value to be set to the specified N if it is already less than N
- Used with the 'scrub' action

One final feature: macros

Macros are just variables

Very similar to scalar shell variables

      ext_if = "fxp0"

or

      my_net = "10.0.0.0/24"

And expanded in the traditional manner (in firewall rules)
```
    pass out on $ext_if from $my_net to any
```

Constructing a firewall

The first rules express your default policy

The default rules that PF uses if you don't specify any are:
```
  pass out all
  pass in all
```
- I leave these in my firewall as a reminder
- They apply to every interface on the machine

For traffic from the Internet, I use something more draconian:

  ext = "fxp0"
  scrub             in       on $ext           all
  block             in  log  on $ext           all
  block return-rst  in  log  on $ext proto tcp all
  block return-icmp in  log  on $ext proto udp all

Here is a good outgoing default:

  block out log quick on $ext from ! $my_ip to any

Here is an important outgoing, stateful, rule:

  pass out log on $ext proto tcp \ 
          from any to any keep state

We already allow outgoing traffic, but..
The keep-state adds a dynamic rule to our firewall for return TCP traffic

Be sure to block bogus incoming source IP addrs:

  block in log quick on $ext from { \ 
           10.0.0.0/8,            \ 
           172.16.0.0/12,         \ 
           192.168.0.0/16,        \ 
           localhost,             \ 
           0.0.0.0/32,            \ 
           255.255.255.255/32     \ 
 } to any

RFC 1918 addresses
Your own internal IP addresses
Bogus addresses like 'localhost'

Now add holes in the firewall to allow certain services

Here is an ICMP rule:

  pass in on $ext inet proto icmp all \ 
         icmp-type { echorep, timex, unreach }

Here is a UDP rule:

  pass in on $ext inet proto udp from any to any \ 
         port { = domain, = 1053 }

And finally, here is a TCP rule:

  pass in on $ext inet proto tcp from any to any \ 
      port { = smtp, = http, = https, = ssh }

Optimization

PF parser will SKIP unnecessary rules when matching

Kind of like Rule Groups; referred to as 'skip-steps'

For example, consider a list of rules:

 block in quick on xl0 from 10.0.0.0/8 to any
 block in quick on xl0 from 172.16.0.0/12 to any
 block in quick on xl0 from 192.168.0.0/16 to any
 block in quick on xl0 from 255.255.255.255/32 to any

If a packet was received on interface 'xl1'
- then only the first rule would be checked, the remaining three would be skipped over

This optimization only works for consecutive rules

Skip-Steps are computed based on a prioritized list of parameters

     interface

     protocol

     source address

     source port

     destination address

     destination port

Sorting a ruleset based on these parameters can yield a big performance win
- Sort first by interface, then by protocol within each interface group, and so on