1.\" $NetBSD: pf.conf.5,v 1.11 2007/05/10 23:03:22 dyoung Exp $ 2.\" $OpenBSD: pf.conf.5,v 1.326 2005/03/01 18:10:44 jmc Exp $ 3.\" 4.\" Copyright (c) 2002, Daniel Hartmeier 5.\" All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 11.\" - Redistributions of source code must retain the above copyright 12.\" notice, this list of conditions and the following disclaimer. 13.\" - Redistributions in binary form must reproduce the above 14.\" copyright notice, this list of conditions and the following 15.\" disclaimer in the documentation and/or other materials provided 16.\" with the distribution. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19.\" "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 20.\" LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 21.\" FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 22.\" COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 23.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 24.\" BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 25.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 26.\" CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 28.\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29.\" POSSIBILITY OF SUCH DAMAGE. 30.\" 31.Dd April 26, 2006 32.Dt PF.CONF 5 33.Os 34.Sh NAME 35.Nm pf.conf 36.Nd packet filter configuration file 37.Sh DESCRIPTION 38The 39.Xr pf 4 40packet filter modifies, drops or passes packets according to rules or 41definitions specified in 42.Nm pf.conf . 43.Sh STATEMENT ORDER 44There are seven types of statements in 45.Nm pf.conf : 46.Bl -tag -width xxxx 47.It Cm Macros 48User-defined variables may be defined and used later, simplifying 49the configuration file. 50Macros must be defined before they are referenced in 51.Nm pf.conf . 52.It Cm Tables 53Tables provide a mechanism for increasing the performance and flexibility of 54rules with large numbers of source or destination addresses. 55.It Cm Options 56Options tune the behaviour of the packet filtering engine. 57.It Cm Traffic Normalization Li (e.g. Em scrub ) 58Traffic normalization protects internal machines against inconsistencies 59in Internet protocols and implementations. 60.It Cm Queueing 61Queueing provides rule-based bandwidth control. 62.It Cm Translation Li (Various forms of NAT) 63Translation rules specify how addresses are to be mapped or redirected to 64other addresses. 65.It Cm Packet Filtering 66Stateful and stateless packet filtering provides rule-based blocking or 67passing of packets. 68.El 69.Pp 70With the exception of 71.Cm macros 72and 73.Cm tables , 74the types of statements should be grouped and appear in 75.Nm pf.conf 76in the order shown above, as this matches the operation of the underlying 77packet filtering engine. 78By default 79.Xr pfctl 8 80enforces this order (see 81.Ar set require-order 82below). 83.Sh MACROS 84Much like 85.Xr cpp 1 86or 87.Xr m4 1 , 88macros can be defined that will later be expanded in context. 89Macro names must start with a letter, and may contain letters, digits 90and underscores. 91Macro names may not be reserved words (for example 92.Ar pass , 93.Ar in , 94.Ar out ) . 95Macros are not expanded inside quotes. 96.Pp 97For example, 98.Bd -literal -offset indent 99ext_if = \&"kue0\&" 100all_ifs = \&"{\&" $ext_if lo0 \&"}\&" 101pass out on $ext_if from any to any keep state 102pass in on $ext_if proto tcp from any to any port 25 keep state 103.Ed 104.Sh TABLES 105Tables are named structures which can hold a collection of addresses and 106networks. 107Lookups against tables in 108.Xr pf 4 109are relatively fast, making a single rule with tables much more efficient, 110in terms of 111processor usage and memory consumption, than a large number of rules which 112differ only in IP address (either created explicitly or automatically by rule 113expansion). 114.Pp 115Tables can be used as the source or destination of filter rules, 116.Ar scrub 117rules 118or 119translation rules such as 120.Ar nat 121or 122.Ar rdr 123(see below for details on the various rule types). 124Tables can also be used for the redirect address of 125.Ar nat 126and 127.Ar rdr 128rules and in the routing options of filter rules, but only for 129.Ar round-robin 130pools. 131.Pp 132Tables can be defined with any of the following 133.Xr pfctl 8 134mechanisms. 135As with macros, reserved words may not be used as table names. 136.Bl -tag -width "manually" 137.It Ar manually 138Persistent tables can be manually created with the 139.Ar add 140or 141.Ar replace 142option of 143.Xr pfctl 8 , 144before or after the ruleset has been loaded. 145.It Pa pf.conf 146Table definitions can be placed directly in this file, and loaded at the 147same time as other rules are loaded, atomically. 148Table definitions inside 149.Nm pf.conf 150use the 151.Ar table 152statement, and are especially useful to define non-persistent tables. 153The contents of a pre-existing table defined without a list of addresses 154to initialize it is not altered when 155.Nm pf.conf 156is loaded. 157A table initialized with the empty list, 158.Li { } , 159will be cleared on load. 160.El 161.Pp 162Tables may be defined with the following two attributes: 163.Bl -tag -width persist 164.It Ar persist 165The 166.Ar persist 167flag forces the kernel to keep the table even when no rules refer to it. 168If the flag is not set, the kernel will automatically remove the table 169when the last rule referring to it is flushed. 170.It Ar const 171The 172.Ar const 173flag prevents the user from altering the contents of the table once it 174has been created. 175Without that flag, 176.Xr pfctl 8 177can be used to add or remove addresses from the table at any time, even 178when running with securelevel = 2. 179.El 180.Pp 181For example, 182.Bd -literal -offset indent 183table <private> const { 10/8, 172.16/12, 192.168/16 } 184table <badhosts> persist 185block on fxp0 from { <private>, <badhosts> } to any 186.Ed 187.Pp 188creates a table called private, to hold RFC 1918 private network 189blocks, and a table called badhosts, which is initially empty. 190A filter rule is set up to block all traffic coming from addresses listed in 191either table. 192The private table cannot have its contents changed and the badhosts table 193will exist even when no active filter rules reference it. 194Addresses may later be added to the badhosts table, so that traffic from 195these hosts can be blocked by using 196.Bd -literal -offset indent 197# pfctl -t badhosts -Tadd 204.92.77.111 198.Ed 199.Pp 200A table can also be initialized with an address list specified in one or more 201external files, using the following syntax: 202.Bd -literal -offset indent 203table <spam> persist file \&"/etc/spammers\&" file \&"/etc/openrelays\&" 204block on fxp0 from <spam> to any 205.Ed 206.Pp 207The files 208.Pa /etc/spammers 209and 210.Pa /etc/openrelays 211list IP addresses, one per line. 212Any lines beginning with a # are treated as comments and ignored. 213In addition to being specified by IP address, hosts may also be 214specified by their hostname. 215When the resolver is called to add a hostname to a table, 216.Em all 217resulting IPv4 and IPv6 addresses are placed into the table. 218IP addresses can also be entered in a table by specifying a valid interface 219name or the 220.Em self 221keyword, in which case all addresses assigned to the interface(s) will be 222added to the table. 223.Sh OPTIONS 224.Xr pf 4 225may be tuned for various situations using the 226.Ar set 227command. 228.Bl -tag -width xxxx 229.It Ar set timeout 230.Pp 231.Bl -tag -width "src.track" -compact 232.It Ar interval 233Interval between purging expired states and fragments. 234.It Ar frag 235Seconds before an unassembled fragment is expired. 236.It Ar src.track 237Length of time to retain a source tracking entry after the last state 238expires. 239.El 240.Pp 241When a packet matches a stateful connection, the seconds to live for the 242connection will be updated to that of the 243.Ar proto.modifier 244which corresponds to the connection state. 245Each packet which matches this state will reset the TTL. 246Tuning these values may improve the performance of the 247firewall at the risk of dropping valid idle connections. 248.Pp 249.Bl -tag -width xxxx -compact 250.It Ar tcp.first 251The state after the first packet. 252.It Ar tcp.opening 253The state before the destination host ever sends a packet. 254.It Ar tcp.established 255The fully established state. 256.It Ar tcp.closing 257The state after the first FIN has been sent. 258.It Ar tcp.finwait 259The state after both FINs have been exchanged and the connection is closed. 260Some hosts (notably web servers on Solaris) send TCP packets even after closing 261the connection. 262Increasing 263.Ar tcp.finwait 264(and possibly 265.Ar tcp.closing ) 266can prevent blocking of such packets. 267.It Ar tcp.closed 268The state after one endpoint sends an RST. 269.El 270.Pp 271ICMP and UDP are handled in a fashion similar to TCP, but with a much more 272limited set of states: 273.Pp 274.Bl -tag -width xxxx -compact 275.It Ar udp.first 276The state after the first packet. 277.It Ar udp.single 278The state if the source host sends more than one packet but the destination 279host has never sent one back. 280.It Ar udp.multiple 281The state if both hosts have sent packets. 282.It Ar icmp.first 283The state after the first packet. 284.It Ar icmp.error 285The state after an ICMP error came back in response to an ICMP packet. 286.El 287.Pp 288Other protocols are handled similarly to UDP: 289.Pp 290.Bl -tag -width xxxx -compact 291.It Ar other.first 292.It Ar other.single 293.It Ar other.multiple 294.El 295.Pp 296Timeout values can be reduced adaptively as the number of state table 297entries grows. 298.Pp 299.Bl -tag -width xxxx -compact 300.It Ar adaptive.start 301When the number of state entries exceeds this value, adaptive scaling 302begins. 303All timeout values are scaled linearly with factor 304(adaptive.end - number of states) / (adaptive.end - adaptive.start). 305.It Ar adaptive.end 306When reaching this number of state entries, all timeout values become 307zero, effectively purging all state entries immediately. 308This value is used to define the scale factor, it should not actually 309be reached (set a lower state limit, see below). 310.El 311.Pp 312These values can be defined both globally and for each rule. 313When used on a per-rule basis, the values relate to the number of 314states created by the rule, otherwise to the total number of 315states. 316.Pp 317For example: 318.Bd -literal -offset indent 319set timeout tcp.first 120 320set timeout tcp.established 86400 321set timeout { adaptive.start 6000, adaptive.end 12000 } 322set limit states 10000 323.Ed 324.Pp 325With 9000 state table entries, the timeout values are scaled to 50% 326(tcp.first 60, tcp.established 43200). 327.Pp 328.It Ar set loginterface 329Enable collection of packet and byte count statistics for the given interface. 330These statistics can be viewed using 331.Bd -literal -offset indent 332# pfctl -s info 333.Ed 334.Pp 335In this example 336.Xr pf 4 337collects statistics on the interface named dc0: 338.Bd -literal -offset indent 339set loginterface dc0 340.Ed 341.Pp 342One can disable the loginterface using: 343.Bd -literal -offset indent 344set loginterface none 345.Ed 346.Pp 347.It Ar set limit 348Sets hard limits on the memory pools used by the packet filter. 349See 350.Xr pool 9 351for an explanation of memory pools. 352.Pp 353For example, 354.Bd -literal -offset indent 355set limit states 20000 356.Ed 357.Pp 358sets the maximum number of entries in the memory pool used by state table 359entries (generated by 360.Ar keep state 361rules) to 20000. 362Using 363.Bd -literal -offset indent 364set limit frags 20000 365.Ed 366.Pp 367sets the maximum number of entries in the memory pool used for fragment 368reassembly (generated by 369.Ar scrub 370rules) to 20000. 371Finally, 372.Bd -literal -offset indent 373set limit src-nodes 2000 374.Ed 375.Pp 376sets the maximum number of entries in the memory pool used for tracking 377source IP addresses (generated by the 378.Ar sticky-address 379and 380.Ar source-track 381options) to 2000. 382.Pp 383These can be combined: 384.Bd -literal -offset indent 385set limit { states 20000, frags 20000, src-nodes 2000 } 386.Ed 387.Pp 388.It Ar set optimization 389Optimize the engine for one of the following network environments: 390.Pp 391.Bl -tag -width xxxx -compact 392.It Ar normal 393A normal network environment. 394Suitable for almost all networks. 395.It Ar high-latency 396A high-latency environment (such as a satellite connection). 397.It Ar satellite 398Alias for 399.Ar high-latency . 400.It Ar aggressive 401Aggressively expire connections. 402This can greatly reduce the memory usage of the firewall at the cost of 403dropping idle connections early. 404.It Ar conservative 405Extremely conservative settings. 406Avoid dropping legitimate connections at the 407expense of greater memory utilization (possibly much greater on a busy 408network) and slightly increased processor utilization. 409.El 410.Pp 411For example: 412.Bd -literal -offset indent 413set optimization aggressive 414.Ed 415.Pp 416.It Ar set block-policy 417The 418.Ar block-policy 419option sets the default behaviour for the packet 420.Ar block 421action: 422.Pp 423.Bl -tag -width xxxxxxxx -compact 424.It Ar drop 425Packet is silently dropped. 426.It Ar return 427A TCP RST is returned for blocked TCP packets, 428an ICMP UNREACHABLE is returned for blocked UDP packets, 429and all other packets are silently dropped. 430.El 431.Pp 432For example: 433.Bd -literal -offset indent 434set block-policy return 435.Ed 436.It Ar set state-policy 437The 438.Ar state-policy 439option sets the default behaviour for states: 440.Pp 441.Bl -tag -width group-bound -compact 442.It Ar if-bound 443States are bound to interface. 444.It Ar group-bound 445States are bound to interface group (i.e. ppp) 446.It Ar floating 447States can match packets on any interfaces (the default). 448.El 449.Pp 450For example: 451.Bd -literal -offset indent 452set state-policy if-bound 453.Ed 454.It Ar set require-order 455By default 456.Xr pfctl 8 457enforces an ordering of the statement types in the ruleset to: 458.Em options , 459.Em normalization , 460.Em queueing , 461.Em translation , 462.Em filtering . 463Setting this option to 464.Ar no 465disables this enforcement. 466There may be non-trivial and non-obvious implications to an out of 467order ruleset. 468Consider carefully before disabling the order enforcement. 469.It Ar set fingerprints 470Load fingerprints of known operating systems from the given filename. 471By default fingerprints of known operating systems are automatically 472loaded from 473.Xr pf.os 5 474in 475.Pa /etc 476but can be overridden via this option. 477Setting this option may leave a small period of time where the fingerprints 478referenced by the currently active ruleset are inconsistent until the new 479ruleset finishes loading. 480.Pp 481For example: 482.Pp 483.Dl set fingerprints \&"/etc/pf.os.devel\&" 484.Pp 485.It Ar set skip on <ifspec> 486List interfaces for which packets should not be filtered. 487Packets passing in or out on such interfaces are passed as if pf was 488disabled, i.e. pf does not process them in any way. 489This can be useful on loopback and other virtual interfaces, when 490packet filtering is not desired and can have unexpected effects. 491For example: 492.Pp 493.Dl set skip on lo0 494.Pp 495.It Ar set debug 496Set the debug 497.Ar level 498to one of the following: 499.Pp 500.Bl -tag -width xxxxxxxxxxxx -compact 501.It Ar none 502Don't generate debug messages. 503.It Ar urgent 504Generate debug messages only for serious errors. 505.It Ar misc 506Generate debug messages for various errors. 507.It Ar loud 508Generate debug messages for common conditions. 509.El 510.El 511.Sh TRAFFIC NORMALIZATION 512Traffic normalization is used to sanitize packet content in such 513a way that there are no ambiguities in packet interpretation on 514the receiving side. 515The normalizer does IP fragment reassembly to prevent attacks 516that confuse intrusion detection systems by sending overlapping 517IP fragments. 518Packet normalization is invoked with the 519.Ar scrub 520directive. 521.Pp 522.Ar scrub 523has the following options: 524.Bl -tag -width xxxx 525.It Ar no-df 526Clears the 527.Ar dont-fragment 528bit from a matching IP packet. 529Some operating systems are known to generate fragmented packets with the 530.Ar dont-fragment 531bit set. 532This is particularly true with NFS. 533.Ar Scrub 534will drop such fragmented 535.Ar dont-fragment 536packets unless 537.Ar no-df 538is specified. 539.Pp 540Unfortunately some operating systems also generate their 541.Ar dont-fragment 542packets with a zero IP identification field. 543Clearing the 544.Ar dont-fragment 545bit on packets with a zero IP ID may cause deleterious results if an 546upstream router later fragments the packet. 547Using the 548.Ar random-id 549modifier (see below) is recommended in combination with the 550.Ar no-df 551modifier to ensure unique IP identifiers. 552.It Ar min-ttl <number> 553Enforces a minimum TTL for matching IP packets. 554.It Ar max-mss <number> 555Enforces a maximum MSS for matching TCP packets. 556.It Ar random-id 557Replaces the IP identification field with random values to compensate 558for predictable values generated by many hosts. 559This option only applies to packets that are not fragmented 560after the optional fragment reassembly. 561.It Ar fragment reassemble 562Using 563.Ar scrub 564rules, fragments can be reassembled by normalization. 565In this case, fragments are buffered until they form a complete 566packet, and only the completed packet is passed on to the filter. 567The advantage is that filter rules have to deal only with complete 568packets, and can ignore fragments. 569The drawback of caching fragments is the additional memory cost. 570But the full reassembly method is the only method that currently works 571with NAT. 572This is the default behavior of a 573.Ar scrub 574rule if no fragmentation modifier is supplied. 575.It Ar fragment crop 576The default fragment reassembly method is expensive, hence the option 577to crop is provided. 578In this case, 579.Xr pf 4 580will track the fragments and cache a small range descriptor. 581Duplicate fragments are dropped and overlaps are cropped. 582Thus data will only occur once on the wire with ambiguities resolving to 583the first occurrence. 584Unlike the 585.Ar fragment reassemble 586modifier, fragments are not buffered, they are passed as soon as they 587are received. 588The 589.Ar fragment crop 590reassembly mechanism does not yet work with NAT. 591.Pp 592.It Ar fragment drop-ovl 593This option is similar to the 594.Ar fragment crop 595modifier except that all overlapping or duplicate fragments will be 596dropped, and all further corresponding fragments will be 597dropped as well. 598.It Ar reassemble tcp 599Statefully normalizes TCP connections. 600.Ar scrub reassemble tcp 601rules may not have the direction (in/out) specified. 602.Ar reassemble tcp 603performs the following normalizations: 604.Pp 605.Bl -tag -width timeout -compact 606.It ttl 607Neither side of the connection is allowed to reduce their IP TTL. 608An attacker may send a packet such that it reaches the firewall, affects 609the firewall state, and expires before reaching the destination host. 610.Ar reassemble tcp 611will raise the TTL of all packets back up to the highest value seen on 612the connection. 613.It timestamp modulation 614Modern TCP stacks will send a timestamp on every TCP packet and echo 615the other endpoint's timestamp back to them. 616Many operating systems will merely start the timestamp at zero when 617first booted, and increment it several times a second. 618The uptime of the host can be deduced by reading the timestamp and multiplying 619by a constant. 620Also observing several different timestamps can be used to count hosts 621behind a NAT device. 622And spoofing TCP packets into a connection requires knowing or guessing 623valid timestamps. 624Timestamps merely need to be monotonically increasing and not derived off a 625guessable base time. 626.Ar reassemble tcp 627will cause 628.Ar scrub 629to modulate the TCP timestamps with a random number. 630.It extended PAWS checks 631There is a problem with TCP on long fat pipes, in that a packet might get 632delayed for longer than it takes the connection to wrap its 32-bit sequence 633space. 634In such an occurrence, the old packet would be indistinguishable from a 635new packet and would be accepted as such. 636The solution to this is called PAWS: Protection Against Wrapped Sequence 637numbers. 638It protects against it by making sure the timestamp on each packet does 639not go backwards. 640.Ar reassemble tcp 641also makes sure the timestamp on the packet does not go forward more 642than the RFC allows. 643By doing this, 644.Xr pf 4 645artificially extends the security of TCP sequence numbers by 10 to 18 646bits when the host uses appropriately randomized timestamps, since a 647blind attacker would have to guess the timestamp as well. 648.El 649.El 650.Pp 651For example, 652.Bd -literal -offset indent 653scrub in on $ext_if all fragment reassemble 654.Ed 655.Pp 656The 657.Ar no 658option prefixed to a scrub rule causes matching packets to remain unscrubbed, 659much in the same way as 660.Ar drop quick 661works in the packet filter (see below). 662This mechanism should be used when it is necessary to exclude specific packets 663from broader scrub rules. 664.Sh QUEUEING 665Packets can be assigned to queues for the purpose of bandwidth 666control. 667At least two declarations are required to configure queues, and later 668any packet filtering rule can reference the defined queues by name. 669During the filtering component of 670.Nm pf.conf , 671the last referenced 672.Ar queue 673name is where any packets from 674.Ar pass 675rules will be queued, while for 676.Ar block 677rules it specifies where any resulting ICMP or TCP RST 678packets should be queued. 679The 680.Ar scheduler 681defines the algorithm used to decide which packets get delayed, dropped, or 682sent out immediately. 683There are three 684.Ar schedulers 685currently supported. 686.Bl -tag -width xxxx 687.It Ar cbq 688Class Based Queueing. 689.Ar Queues 690attached to an interface build a tree, thus each 691.Ar queue 692can have further child 693.Ar queues . 694Each queue can have a 695.Ar priority 696and a 697.Ar bandwidth 698assigned. 699.Ar Priority 700mainly controls the time packets take to get sent out, while 701.Ar bandwidth 702has primarily effects on throughput. 703.Ar cbq 704achieves both partitioning and sharing of link bandwidth 705by hierarchically structured classes. 706Each class has its own 707.Ar queue 708and is assigned its share of 709.Ar bandwidth . 710A child class can borrow bandwidth from its parent class 711as long as excess bandwidth is available 712(see the option 713.Ar borrow , 714below). 715.It Ar priq 716Priority Queueing. 717.Ar Queues 718are flat attached to the interface, thus, 719.Ar queues 720cannot have further child 721.Ar queues . 722Each 723.Ar queue 724has a unique 725.Ar priority 726assigned, ranging from 0 to 15. 727Packets in the 728.Ar queue 729with the highest 730.Ar priority 731are processed first. 732.It Ar hfsc 733Hierarchical Fair Service Curve. 734.Ar Queues 735attached to an interface build a tree, thus each 736.Ar queue 737can have further child 738.Ar queues . 739Each queue can have a 740.Ar priority 741and a 742.Ar bandwidth 743assigned. 744.Ar Priority 745mainly controls the time packets take to get sent out, while 746.Ar bandwidth 747has primarily effects on throughput. 748.Ar hfsc 749supports both link-sharing and guaranteed real-time services. 750It employs a service curve based QoS model, 751and its unique feature is an ability to decouple 752.Ar delay 753and 754.Ar bandwidth 755allocation. 756.El 757.Pp 758The interfaces on which queueing should be activated are declared using 759the 760.Ar altq on 761declaration. 762.Ar altq on 763has the following keywords: 764.Bl -tag -width xxxx 765.It Ar <interface> 766Queueing is enabled on the named interface. 767.It Ar <scheduler> 768Specifies which queueing scheduler to use. 769Currently supported values 770are 771.Ar cbq 772for Class Based Queueing, 773.Ar priq 774for Priority Queueing and 775.Ar hfsc 776for the Hierarchical Fair Service Curve scheduler. 777.It Ar bandwidth <bw> 778The maximum bitrate for all queues on an 779interface may be specified using the 780.Ar bandwidth 781keyword. 782The value can be specified as an absolute value or as a 783percentage of the interface bandwidth. 784When using an absolute value, the suffixes 785.Ar b , 786.Ar Kb , 787.Ar Mb , 788and 789.Ar Gb 790are used to represent bits, kilobits, megabits, and 791gigabits per second, respectively. 792The value must not exceed the interface bandwidth. 793If 794.Ar bandwidth 795is not specified, the interface bandwidth is used. 796.It Ar qlimit <limit> 797The maximum number of packets held in the queue. 798The default is 50. 799.It Ar tbrsize <size> 800Adjusts the size, in bytes, of the token bucket regulator. 801If not specified, heuristics based on the 802interface bandwidth are used to determine the size. 803.It Ar queue <list> 804Defines a list of subqueues to create on an interface. 805.El 806.Pp 807In the following example, the interface dc0 808should queue up to 5 Mbit/s in four second-level queues using 809Class Based Queueing. 810Those four queues will be shown in a later example. 811.Bd -literal -offset indent 812altq on dc0 cbq bandwidth 5Mb queue { std, http, mail, ssh } 813.Ed 814.Pp 815Once interfaces are activated for queueing using the 816.Ar altq 817directive, a sequence of 818.Ar queue 819directives may be defined. 820The name associated with a 821.Ar queue 822must match a queue defined in the 823.Ar altq 824directive (e.g. mail), or, except for the 825.Ar priq 826.Ar scheduler , 827in a parent 828.Ar queue 829declaration. 830The following keywords can be used: 831.Bl -tag -width xxxx 832.It Ar on <interface> 833Specifies the interface the queue operates on. 834If not given, it operates on all matching interfaces. 835.It Ar bandwidth <bw> 836Specifies the maximum bitrate to be processed by the queue. 837This value must not exceed the value of the parent 838.Ar queue 839and can be specified as an absolute value or a percentage of the parent 840queue's bandwidth. 841If not specified, defaults to 100% of the parent queue's bandwidth. 842The 843.Ar priq 844scheduler does not support bandwidth specification. 845.It Ar priority <level> 846Between queues a priority level can be set. 847For 848.Ar cbq 849and 850.Ar hfsc , 851the range is 0 to 7 and for 852.Ar priq , 853the range is 0 to 15. 854The default for all is 1. 855.Ar Priq 856queues with a higher priority are always served first. 857.Ar Cbq 858and 859.Ar Hfsc 860queues with a higher priority are preferred in the case of overload. 861.It Ar qlimit <limit> 862The maximum number of packets held in the queue. 863The default is 50. 864.El 865.Pp 866The 867.Ar scheduler 868can get additional parameters with 869.Ar <scheduler> Ns Li (\& Ar <parameters> No ) . 870Parameters are as follows: 871.Bl -tag -width Fl 872.It Ar default 873Packets not matched by another queue are assigned to this one. 874Exactly one default queue is required. 875.It Ar red 876Enable RED (Random Early Detection) on this queue. 877RED drops packets with a probability proportional to the average 878queue length. 879.It Ar rio 880Enables RIO on this queue. 881RIO is RED with IN/OUT, thus running 882RED two times more than RIO would achieve the same effect. 883RIO is currently not supported in the GENERIC kernel. 884.It Ar ecn 885Enables ECN (Explicit Congestion Notification) on this queue. 886ECN implies RED. 887.El 888.Pp 889The 890.Ar cbq 891.Ar scheduler 892supports an additional option: 893.Bl -tag -width Fl 894.It Ar borrow 895The queue can borrow bandwidth from the parent. 896.El 897.Pp 898The 899.Ar hfsc 900.Ar scheduler 901supports some additional options: 902.Bl -tag -width Fl 903.It Ar realtime <sc> 904The minimum required bandwidth for the queue. 905.It Ar upperlimit <sc> 906The maximum allowed bandwidth for the queue. 907.It Ar linkshare <sc> 908The bandwidth share of a backlogged queue. 909.El 910.Pp 911<sc> is an acronym for 912.Ar service curve . 913.Pp 914The format for service curve specifications is 915.Ar ( m1 , d , m2 ) . 916.Ar m2 917controls the bandwidth assigned to the queue. 918.Ar m1 919and 920.Ar d 921are optional and can be used to control the initial bandwidth assignment. 922For the first 923.Ar d 924milliseconds the queue gets the bandwidth given as 925.Ar m1 , 926afterwards the value given in 927.Ar m2 . 928.Pp 929Furthermore, with 930.Ar cbq 931and 932.Ar hfsc , 933child queues can be specified as in an 934.Ar altq 935declaration, thus building a tree of queues using a part of 936their parent's bandwidth. 937.Pp 938Packets can be assigned to queues based on filter rules by using the 939.Ar queue 940keyword. 941Normally only one 942.Ar queue 943is specified; when a second one is specified it will instead be used for 944packets which have a 945.Em TOS 946of 947.Em lowdelay 948and for TCP ACKs with no data payload. 949.Pp 950To continue the previous example, the examples below would specify the 951four referenced 952queues, plus a few child queues. 953Interactive 954.Xr ssh 1 955sessions get priority over bulk transfers like 956.Xr scp 1 957and 958.Xr sftp 1 . 959The queues may then be referenced by filtering rules (see 960.Sx PACKET FILTERING 961below). 962.Bd -literal 963queue std bandwidth 10% cbq(default) 964queue http bandwidth 60% priority 2 cbq(borrow red) \e 965 { employees, developers } 966queue developers bandwidth 75% cbq(borrow) 967queue employees bandwidth 15% 968queue mail bandwidth 10% priority 0 cbq(borrow ecn) 969queue ssh bandwidth 20% cbq(borrow) { ssh_interactive, ssh_bulk } 970queue ssh_interactive bandwidth 50% priority 7 cbq(borrow) 971queue ssh_bulk bandwidth 50% priority 0 cbq(borrow) 972 973block return out on dc0 inet all queue std 974pass out on dc0 inet proto tcp from $developerhosts to any port 80 \e 975 keep state queue developers 976pass out on dc0 inet proto tcp from $employeehosts to any port 80 \e 977 keep state queue employees 978pass out on dc0 inet proto tcp from any to any port 22 \e 979 keep state queue(ssh_bulk, ssh_interactive) 980pass out on dc0 inet proto tcp from any to any port 25 \e 981 keep state queue mail 982.Ed 983.Sh TRANSLATION 984Translation rules modify either the source or destination address of the 985packets associated with a stateful connection. 986A stateful connection is automatically created to track packets matching 987such a rule as long as they are not blocked by the filtering section of 988.Nm pf.conf . 989The translation engine modifies the specified address and/or port in the 990packet, recalculates IP, TCP and UDP checksums as necessary, and passes it to 991the packet filter for evaluation. 992.Pp 993Since translation occurs before filtering the filter 994engine will see packets as they look after any 995addresses and ports have been translated. 996Filter rules will therefore have to filter based on the translated 997address and port number. 998Packets that match a translation rule are only automatically passed if 999the 1000.Ar pass 1001modifier is given, otherwise they are 1002still subject to 1003.Ar block 1004and 1005.Ar pass 1006rules. 1007.Pp 1008The state entry created permits 1009.Xr pf 4 1010to keep track of the original address for traffic associated with that state 1011and correctly direct return traffic for that connection. 1012.Pp 1013Various types of translation are possible with pf: 1014.Bl -tag -width xxxx 1015.It Ar binat 1016A 1017.Ar binat 1018rule specifies a bidirectional mapping between an external IP netblock 1019and an internal IP netblock. 1020.It Ar nat 1021A 1022.Ar nat 1023rule specifies that IP addresses are to be changed as the packet 1024traverses the given interface. 1025This technique allows one or more IP addresses 1026on the translating host to support network traffic for a larger range of 1027machines on an "inside" network. 1028Although in theory any IP address can be used on the inside, it is strongly 1029recommended that one of the address ranges defined by RFC 1918 be used. 1030These netblocks are: 1031.Bd -literal 103210.0.0.0 - 10.255.255.255 (all of net 10, i.e., 10/8) 1033172.16.0.0 - 172.31.255.255 (i.e., 172.16/12) 1034192.168.0.0 - 192.168.255.255 (i.e., 192.168/16) 1035.Ed 1036.It Pa rdr 1037The packet is redirected to another destination and possibly a 1038different port. 1039.Ar rdr 1040rules can optionally specify port ranges instead of single ports. 1041rdr ... port 2000:2999 -> ... port 4000 1042redirects ports 2000 to 2999 (inclusive) to port 4000. 1043rdr ... port 2000:2999 -> ... port 4000:* 1044redirects port 2000 to 4000, 2001 to 4001, ..., 2999 to 4999. 1045.El 1046.Pp 1047In addition to modifying the address, some translation rules may modify 1048source or destination ports for 1049.Xr tcp 4 1050or 1051.Xr udp 4 1052connections; implicitly in the case of 1053.Ar nat 1054rules and explicitly in the case of 1055.Ar rdr 1056rules. 1057Port numbers are never translated with a 1058.Ar binat 1059rule. 1060.Pp 1061For each packet processed by the translator, the translation rules are 1062evaluated in sequential order, from first to last. 1063The first matching rule decides what action is taken. 1064.Pp 1065The 1066.Ar no 1067option prefixed to a translation rule causes packets to remain untranslated, 1068much in the same way as 1069.Ar drop quick 1070works in the packet filter (see below). 1071If no rule matches the packet it is passed to the filter engine unmodified. 1072.Pp 1073Translation rules apply only to packets that pass through 1074the specified interface, and if no interface is specified, 1075translation is applied to packets on all interfaces. 1076For instance, redirecting port 80 on an external interface to an internal 1077web server will only work for connections originating from the outside. 1078Connections to the address of the external interface from local hosts will 1079not be redirected, since such packets do not actually pass through the 1080external interface. 1081Redirections cannot reflect packets back through the interface they arrive 1082on, they can only be redirected to hosts connected to different interfaces 1083or to the firewall itself. 1084.Pp 1085Note that redirecting external incoming connections to the loopback 1086address, as in 1087.Bd -literal -offset indent 1088rdr on ne3 inet proto tcp to port 8025 -> 127.0.0.1 port 25 1089.Ed 1090.Pp 1091will effectively allow an external host to connect to daemons 1092bound solely to the loopback address, circumventing the traditional 1093blocking of such connections on a real interface. 1094Unless this effect is desired, any of the local non-loopback addresses 1095should be used as redirection target instead, which allows external 1096connections only to daemons bound to this address or not bound to 1097any address. 1098.Pp 1099See 1100.Sx TRANSLATION EXAMPLES 1101below. 1102.Sh PACKET FILTERING 1103.Xr pf 4 1104has the ability to 1105.Ar block 1106and 1107.Ar pass 1108packets based on attributes of their layer 3 (see 1109.Xr ip 4 1110and 1111.Xr ip6 4 ) 1112and layer 4 (see 1113.Xr icmp 4 , 1114.Xr icmp6 4 , 1115.Xr tcp 4 , 1116.Xr udp 4 ) 1117headers. 1118In addition, packets may also be 1119assigned to queues for the purpose of bandwidth control. 1120.Pp 1121For each packet processed by the packet filter, the filter rules are 1122evaluated in sequential order, from first to last. 1123The last matching rule decides what action is taken. 1124.Pp 1125The following actions can be used in the filter: 1126.Bl -tag -width xxxx 1127.It Ar block 1128The packet is blocked. 1129There are a number of ways in which a 1130.Ar block 1131rule can behave when blocking a packet. 1132The default behaviour is to 1133.Ar drop 1134packets silently, however this can be overridden or made 1135explicit either globally, by setting the 1136.Ar block-policy 1137option, or on a per-rule basis with one of the following options: 1138.Pp 1139.Bl -tag -width xxxx -compact 1140.It Ar drop 1141The packet is silently dropped. 1142.It Ar return-rst 1143This applies only to 1144.Xr tcp 4 1145packets, and issues a TCP RST which closes the 1146connection. 1147.It Ar return-icmp 1148.It Ar return-icmp6 1149This causes ICMP messages to be returned for packets which match the rule. 1150By default this is an ICMP UNREACHABLE message, however this 1151can be overridden by specifying a message as a code or number. 1152.It Ar return 1153This causes a TCP RST to be returned for 1154.Xr tcp 4 1155packets and an ICMP UNREACHABLE for UDP and other packets. 1156.El 1157.Pp 1158Options returning ICMP packets currently have no effect if 1159.Xr pf 4 1160operates on a 1161.Xr bridge 4 , 1162as the code to support this feature has not yet been implemented. 1163.It Ar pass 1164The packet is passed. 1165.El 1166.Pp 1167If no rule matches the packet, the default action is 1168.Ar pass . 1169.Pp 1170To block everything by default and only pass packets 1171that match explicit rules, one uses 1172.Bd -literal -offset indent 1173block all 1174.Ed 1175.Pp 1176as the first filter rule. 1177.Pp 1178See 1179.Sx FILTER EXAMPLES 1180below. 1181.Sh PARAMETERS 1182The rule parameters specify the packets to which a rule applies. 1183A packet always comes in on, or goes out through, one interface. 1184Most parameters are optional. 1185If a parameter is specified, the rule only applies to packets with 1186matching attributes. 1187Certain parameters can be expressed as lists, in which case 1188.Xr pfctl 8 1189generates all needed rule combinations. 1190.Bl -tag -width xxxx 1191.It Ar in No or Ar out 1192This rule applies to incoming or outgoing packets. 1193If neither 1194.Ar in 1195nor 1196.Ar out 1197are specified, the rule will match packets in both directions. 1198.It Ar log 1199In addition to the action specified, a log message is generated. 1200All packets for that connection are logged, unless the 1201.Ar keep state , 1202.Ar modulate state 1203or 1204.Ar synproxy state 1205options are specified, in which case only the 1206packet that establishes the state is logged. 1207(See 1208.Ar keep state , 1209.Ar modulate state 1210and 1211.Ar synproxy state 1212below). 1213The logged packets are sent to the 1214.Xr pflog 4 1215interface. 1216This interface is monitored by the 1217.Xr pflogd 8 1218logging daemon, which dumps the logged packets to the file 1219.Pa /var/log/pflog 1220in 1221.Xr pcap 3 1222binary format. 1223.It Ar log-all 1224Used with 1225.Ar keep state , 1226.Ar modulate state 1227or 1228.Ar synproxy state 1229rules to force logging of all packets for a connection. 1230As with 1231.Ar log , 1232packets are logged to 1233.Xr pflog 4 . 1234.It Ar quick 1235If a packet matches a rule which has the 1236.Ar quick 1237option set, this rule 1238is considered the last matching rule, and evaluation of subsequent rules 1239is skipped. 1240.It Ar on <interface> 1241This rule applies only to packets coming in on, or going out through, this 1242particular interface. 1243It is also possible to simply give the interface driver name, like ppp or fxp, 1244to make the rule match packets flowing through a group of interfaces. 1245.It Ar <af> 1246This rule applies only to packets of this address family. 1247Supported values are 1248.Ar inet 1249and 1250.Ar inet6 . 1251.It Ar proto <protocol> 1252This rule applies only to packets of this protocol. 1253Common protocols are 1254.Xr icmp 4 , 1255.Xr icmp6 4 , 1256.Xr tcp 4 , 1257and 1258.Xr udp 4 . 1259For a list of all the protocol name to number mappings used by 1260.Xr pfctl 8 , 1261see the file 1262.Em /etc/protocols . 1263.It Xo 1264.Ar from <source> port <source> os <source> 1265.Ar to <dest> port <dest> 1266.Xc 1267This rule applies only to packets with the specified source and destination 1268addresses and ports. 1269.Pp 1270Addresses can be specified in CIDR notation (matching netblocks), as 1271symbolic host names or interface names, or as any of the following keywords: 1272.Pp 1273.Bl -tag -width xxxxxxxxxxxxxx -compact 1274.It Ar any 1275Any address. 1276.It Ar route <label> 1277Any address whose associated route has label 1278.Ar <label> . 1279See 1280.Xr route 4 1281and 1282.Xr route 8 . 1283.It Ar no-route 1284Any address which is not currently routable. 1285.It Ar <table> 1286Any address that matches the given table. 1287.El 1288.Pp 1289Interface names can have modifiers appended: 1290.Pp 1291.Bl -tag -width xxxxxxxxxxxx -compact 1292.It Ar :network 1293Translates to the network(s) attached to the interface. 1294.It Ar :broadcast 1295Translates to the interface's broadcast address(es). 1296.It Ar :peer 1297Translates to the point to point interface's peer address(es). 1298.It Ar :0 1299Do not include interface aliases. 1300.El 1301.Pp 1302Host names may also have the 1303.Ar :0 1304option appended to restrict the name resolution to the first of each 1305v4 and v6 address found. 1306.Pp 1307Host name resolution and interface to address translation are done at 1308ruleset load-time. 1309When the address of an interface (or host name) changes (under DHCP or PPP, 1310for instance), the ruleset must be reloaded for the change to be reflected 1311in the kernel. 1312Surrounding the interface name (and optional modifiers) in parentheses 1313changes this behaviour. 1314When the interface name is surrounded by parentheses, the rule is 1315automatically updated whenever the interface changes its address. 1316The ruleset does not need to be reloaded. 1317This is especially useful with 1318.Ar nat . 1319.Pp 1320Ports can be specified either by number or by name. 1321For example, port 80 can be specified as 1322.Em www . 1323For a list of all port name to number mappings used by 1324.Xr pfctl 8 , 1325see the file 1326.Pa /etc/services . 1327.Pp 1328Ports and ranges of ports are specified by using these operators: 1329.Bd -literal -offset indent 1330= (equal) 1331!= (unequal) 1332< (less than) 1333<= (less than or equal) 1334> (greater than) 1335>= (greater than or equal) 1336: (range including boundaries) 1337>< (range excluding boundaries) 1338<> (except range) 1339.Ed 1340.Pp 1341><, <> and : 1342are binary operators (they take two arguments). 1343For instance: 1344.Bl -tag -width Fl 1345.It Ar port 2000:2004 1346means 1347.Sq all ports >= 2000 and <= 2004 , 1348hence ports 2000, 2001, 2002, 2003 and 2004. 1349.It Ar port 2000 >< 2004 1350means 1351.Sq all ports > 2000 and < 2004 , 1352hence ports 2001, 2002 and 2003. 1353.It Ar port 2000 <> 2004 1354means 1355.Sq all ports < 2000 or > 2004 , 1356hence ports 1-1999 and 2005-65535. 1357.El 1358.Pp 1359The operating system of the source host can be specified in the case of TCP 1360rules with the 1361.Ar OS 1362modifier. 1363See the 1364.Sx OPERATING SYSTEM FINGERPRINTING 1365section for more information. 1366.Pp 1367The host, port and OS specifications are optional, as in the following examples: 1368.Bd -literal -offset indent 1369pass in all 1370pass in from any to any 1371pass in proto tcp from any port <= 1024 to any 1372pass in proto tcp from any to any port 25 1373pass in proto tcp from 10.0.0.0/8 port > 1024 \e 1374 to ! 10.1.2.3 port != ssh 1375pass in proto tcp from any os "OpenBSD" flags S/SA 1376pass in proto tcp from route "DTAG" 1377.Ed 1378.It Ar all 1379This is equivalent to "from any to any". 1380.It Ar group <group> 1381This functionality is not supported in this version of 1382.Nx . 1383.\" Similar to 1384.\" .Ar user , 1385.\" this rule only applies to packets of sockets owned by the specified group. 1386.It Ar user <user> 1387This rule only applies to packets of sockets owned by the specified user. 1388For outgoing connections initiated from the firewall, this is the user 1389that opened the connection. 1390For incoming connections to the firewall itself, this is the user that 1391listens on the destination port. 1392For forwarded connections, where the firewall is not a connection endpoint, 1393the user and group are 1394.Em unknown . 1395.Pp 1396All packets, both outgoing and incoming, of one connection are associated 1397with the same user and group. 1398Only TCP and UDP packets can be associated with users; for other protocols 1399these parameters are ignored. 1400.Pp 1401User and group refer to the effective (as opposed to the real) IDs, in 1402case the socket is created by a setuid/setgid process. 1403User and group IDs are stored when a socket is created; 1404when a process creates a listening socket as root (for instance, by 1405binding to a privileged port) and subsequently changes to another 1406user ID (to drop privileges), the credentials will remain root. 1407.Pp 1408User and group IDs can be specified as either numbers or names. 1409The syntax is similar to the one for ports. 1410The value 1411.Em unknown 1412matches packets of forwarded connections. 1413.Em unknown 1414can only be used with the operators 1415.Cm = 1416and 1417.Cm != . 1418Other constructs like 1419.Cm user >= unknown 1420are invalid. 1421Forwarded packets with unknown user and group ID match only rules 1422that explicitly compare against 1423.Em unknown 1424with the operators 1425.Cm = 1426or 1427.Cm != . 1428For instance 1429.Cm user >= 0 1430does not match forwarded packets. 1431The following example allows only selected users to open outgoing 1432connections: 1433.Bd -literal -offset indent 1434block out proto { tcp, udp } all 1435pass out proto { tcp, udp } all \e 1436 user { < 1000, dhartmei } keep state 1437.Ed 1438.It Ar flags <a>/<b> | /<b> 1439This rule only applies to TCP packets that have the flags 1440.Ar <a> 1441set out of set 1442.Ar <b> . 1443Flags not specified in 1444.Ar <b> 1445are ignored. 1446The flags are: (F)IN, (S)YN, (R)ST, (P)USH, (A)CK, (U)RG, (E)CE, and C(W)R. 1447.Bl -tag -width Fl 1448.It Ar flags S/S 1449Flag SYN is set. 1450The other flags are ignored. 1451.It Ar flags S/SA 1452Out of SYN and ACK, exactly SYN may be set. 1453SYN, SYN+PSH and SYN+RST match, but SYN+ACK, ACK and ACK+RST do not. 1454This is more restrictive than the previous example. 1455.It Ar flags /SFRA 1456If the first set is not specified, it defaults to none. 1457All of SYN, FIN, RST and ACK must be unset. 1458.El 1459.It Ar icmp-type <type> code <code> 1460.It Ar icmp6-type <type> code <code> 1461This rule only applies to ICMP or ICMPv6 packets with the specified type 1462and code. 1463Text names for ICMP types and codes are listed in 1464.Xr icmp 4 1465and 1466.Xr icmp6 4 . 1467This parameter is only valid for rules that cover protocols ICMP or 1468ICMP6. 1469The protocol and the ICMP type indicator 1470.Po 1471.Ar icmp-type 1472or 1473.Ar icmp6-type 1474.Pc 1475must match. 1476.It Xo Ar tos Aq Ar string 1477.No \*(Ba Aq Ar number 1478.Xc 1479This rule applies to packets with the specified 1480.Em TOS 1481bits set. 1482.Em TOS 1483may be 1484given as one of 1485.Ar lowdelay , 1486.Ar throughput , 1487.Ar reliability , 1488or as either hex or decimal. 1489.Pp 1490For example, the following rules are identical: 1491.Bd -literal -offset indent 1492pass all tos lowdelay 1493pass all tos 0x10 1494pass all tos 16 1495.Ed 1496.It Ar allow-opts 1497By default, packets which contain IP options are blocked. 1498When 1499.Ar allow-opts 1500is specified for a 1501.Ar pass 1502rule, packets that pass the filter based on that rule (last matching) 1503do so even if they contain IP options. 1504For packets that match state, the rule that initially created the 1505state is used. 1506The implicit 1507.Ar pass 1508rule that is used when a packet does not match any rules does not 1509allow IP options. 1510.It Ar label <string> 1511Adds a label (name) to the rule, which can be used to identify the rule. 1512For instance, 1513pfctl -s labels 1514shows per-rule statistics for rules that have labels. 1515.Pp 1516The following macros can be used in labels: 1517.Pp 1518.Bl -tag -width $srcaddr -compact -offset indent 1519.It Ar $if 1520The interface. 1521.It Ar $srcaddr 1522The source IP address. 1523.It Ar $dstaddr 1524The destination IP address. 1525.It Ar $srcport 1526The source port specification. 1527.It Ar $dstport 1528The destination port specification. 1529.It Ar $proto 1530The protocol name. 1531.It Ar $nr 1532The rule number. 1533.El 1534.Pp 1535For example: 1536.Bd -literal -offset indent 1537ips = \&"{ 1.2.3.4, 1.2.3.5 }\&" 1538pass in proto tcp from any to $ips \e 1539 port > 1023 label \&"$dstaddr:$dstport\&" 1540.Ed 1541.Pp 1542expands to 1543.Bd -literal -offset indent 1544pass in inet proto tcp from any to 1.2.3.4 \e 1545 port > 1023 label \&"1.2.3.4:>1023\&" 1546pass in inet proto tcp from any to 1.2.3.5 \e 1547 port > 1023 label \&"1.2.3.5:>1023\&" 1548.Ed 1549.Pp 1550The macro expansion for the 1551.Ar label 1552directive occurs only at configuration file parse time, not during runtime. 1553.It Ar queue <queue> | ( <queue> , <queue> ) 1554Packets matching this rule will be assigned to the specified queue. 1555If two queues are given, packets which have a 1556.Em TOS 1557of 1558.Em lowdelay 1559and TCP ACKs with no data payload will be assigned to the second one. 1560See 1561.Sx QUEUEING 1562for setup details. 1563.Pp 1564For example: 1565.Bd -literal -offset indent 1566pass in proto tcp to port 25 queue mail 1567pass in proto tcp to port 22 queue(ssh_bulk, ssh_prio) 1568.Ed 1569.It Ar tag <string> 1570Packets matching this rule will be tagged with the 1571specified string. 1572The tag acts as an internal marker that can be used to 1573identify these packets later on. 1574This can be used, for example, to provide trust between 1575interfaces and to determine if packets have been 1576processed by translation rules. 1577Tags are 1578.Qq sticky , 1579meaning that the packet will be tagged even if the rule 1580is not the last matching rule. 1581Further matching rules can replace the tag with a 1582new one but will not remove a previously applied tag. 1583A packet is only ever assigned one tag at a time. 1584.Ar pass 1585rules that use the 1586.Ar tag 1587keyword must also use 1588.Ar keep state , 1589.Ar modulate state 1590or 1591.Ar synproxy state . 1592Packet tagging can be done during 1593.Ar nat , 1594.Ar rdr , 1595or 1596.Ar binat 1597rules in addition to filter rules. 1598Tags take the same macros as labels (see above). 1599.It Ar tagged <string> 1600Used with filter or translation rules to specify that packets must already 1601be tagged with the given tag in order to match the rule. 1602Inverse tag matching can also be done 1603by specifying the 1604.Cm !\& 1605operator before the 1606.Ar tagged 1607keyword. 1608.It Ar probability <number> 1609A probability attribute can be attached to a rule, with a value set between 16100 and 1, bounds not included. 1611In that case, the rule will be honoured using the given probability value 1612only. 1613For example, the following rule will drop 20% of incoming ICMP packets: 1614.Bd -literal -offset indent 1615block in proto icmp probability 20% 1616.Ed 1617.El 1618.Sh ROUTING 1619If a packet matches a rule with a route option set, the packet filter will 1620route the packet according to the type of route option. 1621When such a rule creates state, the route option is also applied to all 1622packets matching the same connection. 1623.Bl -tag -width xxxx 1624.It Ar fastroute 1625The 1626.Ar fastroute 1627option does a normal route lookup to find the next hop for the packet. 1628.It Ar route-to 1629The 1630.Ar route-to 1631option routes the packet to the specified interface with an optional address 1632for the next hop. 1633When a 1634.Ar route-to 1635rule creates state, only packets that pass in the same direction as the 1636filter rule specifies will be routed in this way. 1637Packets passing in the opposite direction (replies) are not affected 1638and are routed normally. 1639.It Ar reply-to 1640The 1641.Ar reply-to 1642option is similar to 1643.Ar route-to , 1644but routes packets that pass in the opposite direction (replies) to the 1645specified interface. 1646Opposite direction is only defined in the context of a state entry, and 1647.Ar reply-to 1648is useful only in rules that create state. 1649It can be used on systems with multiple external connections to 1650route all outgoing packets of a connection through the interface 1651the incoming connection arrived through (symmetric routing enforcement). 1652.It Ar dup-to 1653The 1654.Ar dup-to 1655option creates a duplicate of the packet and routes it like 1656.Ar route-to . 1657The original packet gets routed as it normally would. 1658.El 1659.Sh POOL OPTIONS 1660For 1661.Ar nat 1662and 1663.Ar rdr 1664rules, (as well as for the 1665.Ar route-to , 1666.Ar reply-to 1667and 1668.Ar dup-to 1669rule options) for which there is a single redirection address which has a 1670subnet mask smaller than 32 for IPv4 or 128 for IPv6 (more than one IP 1671address), a variety of different methods for assigning this address can be 1672used: 1673.Bl -tag -width xxxx 1674.It Ar bitmask 1675The 1676.Ar bitmask 1677option applies the network portion of the redirection address to the address 1678to be modified (source with 1679.Ar nat , 1680destination with 1681.Ar rdr ) . 1682.It Ar random 1683The 1684.Ar random 1685option selects an address at random within the defined block of addresses. 1686.It Ar source-hash 1687The 1688.Ar source-hash 1689option uses a hash of the source address to determine the redirection address, 1690ensuring that the redirection address is always the same for a given source. 1691An optional key can be specified after this keyword either in hex or as a 1692string; by default 1693.Xr pfctl 8 1694randomly generates a key for source-hash every time the 1695ruleset is reloaded. 1696.It Ar round-robin 1697The 1698.Ar round-robin 1699option loops through the redirection address(es). 1700.Pp 1701When more than one redirection address is specified, 1702.Ar round-robin 1703is the only permitted pool type. 1704.It Ar static-port 1705With 1706.Ar nat 1707rules, the 1708.Ar static-port 1709option prevents 1710.Xr pf 4 1711from modifying the source port on TCP and UDP packets. 1712.El 1713.Pp 1714Additionally, the 1715.Ar sticky-address 1716option can be specified to help ensure that multiple connections from the 1717same source are mapped to the same redirection address. 1718This option can be used with the 1719.Ar random 1720and 1721.Ar round-robin 1722pool options. 1723Note that by default these associations are destroyed as soon as there are 1724no longer states which refer to them; in order to make the mappings last 1725beyond the lifetime of the states, increase the global options with 1726.Ar set timeout source-track 1727See 1728.Sx STATEFUL TRACKING OPTIONS 1729for more ways to control the source tracking. 1730.Sh STATEFUL INSPECTION 1731.Xr pf 4 1732is a stateful packet filter, which means it can track the state of 1733a connection. 1734Instead of passing all traffic to port 25, for instance, it is possible 1735to pass only the initial packet, and then begin to keep state. 1736Subsequent traffic will flow because the filter is aware of the connection. 1737.Pp 1738If a packet matches a 1739.Ar pass ... keep state 1740rule, the filter creates a state for this connection and automatically 1741lets pass all subsequent packets of that connection. 1742.Pp 1743Before any rules are evaluated, the filter checks whether the packet 1744matches any state. 1745If it does, the packet is passed without evaluation of any rules. 1746.Pp 1747States are removed after the connection is closed or has timed out. 1748.Pp 1749This has several advantages. 1750Comparing a packet to a state involves checking its sequence numbers. 1751If the sequence numbers are outside the narrow windows of expected 1752values, the packet is dropped. 1753This prevents spoofing attacks, such as when an attacker sends packets with 1754a fake source address/port but does not know the connection's sequence 1755numbers. 1756.Pp 1757Also, looking up states is usually faster than evaluating rules. 1758If there are 50 rules, all of them are evaluated sequentially in O(n). 1759Even with 50000 states, only 16 comparisons are needed to match a 1760state, since states are stored in a binary search tree that allows 1761searches in O(log2 n). 1762.Pp 1763For instance: 1764.Bd -literal -offset indent 1765block all 1766pass out proto tcp from any to any flags S/SA keep state 1767pass in proto tcp from any to any port 25 flags S/SA keep state 1768.Ed 1769.Pp 1770This ruleset blocks everything by default. 1771Only outgoing connections and incoming connections to port 25 are allowed. 1772The initial packet of each connection has the SYN 1773flag set, will be passed and creates state. 1774All further packets of these connections are passed if they match a state. 1775.Pp 1776By default, packets coming in and out of any interface can match a state, 1777but it is also possible to change that behaviour by assigning states to a 1778single interface or a group of interfaces. 1779.Pp 1780The default policy is specified by the 1781.Ar state-policy 1782global option, but this can be adjusted on individual filter rules by adding one 1783of the 1784.Ar if-bound , 1785.Ar group-bound 1786or 1787.Ar floating 1788keywords to the 1789.Ar keep state 1790option. 1791For example, if a rule is defined as: 1792.Bd -literal -offset indent 1793pass out on ppp from any to 10.12/16 keep state (group-bound) 1794.Ed 1795.Pp 1796A state created on ppp0 would match packets an all PPP interfaces, 1797but not packets flowing through fxp0 or any other interface. 1798.Pp 1799You can adjust the state policy on individual 1800.Ar nat 1801and 1802.Ar rdr 1803translation rules by adding a keyword 1804.Ar if-bound , 1805.Ar group-bound 1806or 1807.Ar floating 1808at the end of the rule. For example, a rule such as this, 1809.Bd -literal -offset indent 1810nat on sip0 from 10/8 to ! 10/8 -> 192.168.1.4/32 if-bound 1811.Ed 1812.Pp 1813will create states that only match packets on sip0. 1814.Pp 1815Keeping rules 1816.Ar floating 1817is the more flexible option when the firewall is in a dynamic routing 1818environment. 1819However, this has some security implications since a state created by one 1820trusted network could allow potentially hostile packets coming in from other 1821interfaces. 1822.Pp 1823Specifying 1824.Ar flags S/SA 1825restricts state creation to the initial SYN 1826packet of the TCP handshake. 1827One can also be less restrictive, and allow state creation from 1828intermediate 1829.Pq non-SYN 1830packets. 1831This will cause 1832.Xr pf 4 1833to synchronize to existing connections, for instance 1834if one flushes the state table. 1835.Pp 1836For UDP, which is stateless by nature, 1837.Ar keep state 1838will create state as well. 1839UDP packets are matched to states using only host addresses and ports. 1840.Pp 1841ICMP messages fall into two categories: ICMP error messages, which always 1842refer to a TCP or UDP packet, are matched against the referred to connection. 1843If one keeps state on a TCP connection, and an ICMP source quench message 1844referring to this TCP connection arrives, it will be matched to the right 1845state and get passed. 1846.Pp 1847For ICMP queries, 1848.Ar keep state 1849creates an ICMP state, and 1850.Xr pf 4 1851knows how to match ICMP replies to states. 1852For example, 1853.Bd -literal -offset indent 1854pass out inet proto icmp all icmp-type echoreq keep state 1855.Ed 1856.Pp 1857allows echo requests (such as those created by 1858.Xr ping 8 ) 1859out, creates state, and matches incoming echo replies correctly to states. 1860.Pp 1861Note: 1862.Ar nat , binat No and Ar rdr 1863rules implicitly create state for connections. 1864.Sh STATE MODULATION 1865Much of the security derived from TCP is attributable to how well the 1866initial sequence numbers (ISNs) are chosen. 1867Some popular stack implementations choose 1868.Em very 1869poor ISNs and thus are normally susceptible to ISN prediction exploits. 1870By applying a 1871.Ar modulate state 1872rule to a TCP connection, 1873.Xr pf 4 1874will create a high quality random sequence number for each connection 1875endpoint. 1876.Pp 1877The 1878.Ar modulate state 1879directive implicitly keeps state on the rule and is 1880only applicable to TCP connections. 1881.Pp 1882For instance: 1883.Bd -literal -offset indent 1884block all 1885pass out proto tcp from any to any modulate state 1886pass in proto tcp from any to any port 25 flags S/SA modulate state 1887.Ed 1888.Pp 1889There are two caveats associated with state modulation: 1890A 1891.Ar modulate state 1892rule can not be applied to a pre-existing but unmodulated connection. 1893Such an application would desynchronize TCP's strict 1894sequencing between the two endpoints. 1895Instead, 1896.Xr pf 4 1897will treat the 1898.Ar modulate state 1899modifier as a 1900.Ar keep state 1901modifier and the pre-existing connection will be inferred without 1902the protection conferred by modulation. 1903.Pp 1904The other caveat affects currently modulated states when the state table 1905is lost (firewall reboot, flushing the state table, etc...). 1906.Xr pf 4 1907will not be able to infer a connection again after the state table flushes 1908the connection's modulator. 1909When the state is lost, the connection may be left dangling until the 1910respective endpoints time out the connection. 1911It is possible on a fast local network for the endpoints to start an ACK 1912storm while trying to resynchronize after the loss of the modulator. 1913Using a 1914.Ar flags S/SA 1915modifier on 1916.Ar modulate state 1917rules between fast networks is suggested to prevent ACK storms. 1918.Sh SYN PROXY 1919By default, 1920.Xr pf 4 1921passes packets that are part of a 1922.Xr tcp 4 1923handshake between the endpoints. 1924The 1925.Ar synproxy state 1926option can be used to cause 1927.Xr pf 4 1928itself to complete the handshake with the active endpoint, perform a handshake 1929with the passive endpoint, and then forward packets between the endpoints. 1930.Pp 1931No packets are sent to the passive endpoint before the active endpoint has 1932completed the handshake, hence so-called SYN floods with spoofed source 1933addresses will not reach the passive endpoint, as the sender can't complete the 1934handshake. 1935.Pp 1936The proxy is transparent to both endpoints, they each see a single 1937connection from/to the other endpoint. 1938.Xr pf 4 1939chooses random initial sequence numbers for both handshakes. 1940Once the handshakes are completed, the sequence number modulators 1941(see previous section) are used to translate further packets of the 1942connection. 1943Hence, 1944.Ar synproxy state 1945includes 1946.Ar modulate state 1947and 1948.Ar keep state . 1949.Pp 1950Rules with 1951.Ar synproxy 1952will not work if 1953.Xr pf 4 1954operates on a 1955.Xr bridge 4 . 1956.Pp 1957Example: 1958.Bd -literal -offset indent 1959pass in proto tcp from any to any port www flags S/SA synproxy state 1960.Ed 1961.Sh STATEFUL TRACKING OPTIONS 1962All three of 1963.Ar keep state , 1964.Ar modulate state 1965and 1966.Ar synproxy state 1967support the following options: 1968.Pp 1969.Bl -tag -width xxxx -compact 1970.It Ar max <number> 1971Limits the number of concurrent states the rule may create. 1972When this limit is reached, further packets matching the rule that would 1973create state are dropped, until existing states time out. 1974.\" .It Ar no-sync 1975.\" Prevent state changes for states created by this rule from appearing on the 1976.\" .Xr pfsync 4 1977.\" interface. 1978.It Ar <timeout> <seconds> 1979Changes the timeout values used for states created by this rule. 1980For a list of all valid timeout names, see 1981.Sx OPTIONS 1982above. 1983.El 1984.Pp 1985Multiple options can be specified, separated by commas: 1986.Bd -literal -offset indent 1987pass in proto tcp from any to any \e 1988 port www flags S/SA keep state \e 1989 (max 100, source-track rule, max-src-nodes 75, \e 1990 max-src-states 3, tcp.established 60, tcp.closing 5) 1991.Ed 1992.Pp 1993When the 1994.Ar source-track 1995keyword is specified, the number of states per source IP is tracked. 1996.Pp 1997.Bl -tag -width xxxx -compact 1998.It Ar source-track rule 1999The maximum number of states created by this rule is limited by the rule's 2000.Ar max-src-nodes 2001and 2002.Ar max-src-state 2003options. 2004Only state entries created by this particular rule count toward the rule's 2005limits. 2006.It Ar source-track global 2007The number of states created by all rules that use this option is limited. 2008Each rule can specify different 2009.Ar max-src-nodes 2010and 2011.Ar max-src-states 2012options, however state entries created by any participating rule count towards 2013each individual rule's limits. 2014.El 2015.Pp 2016The following limits can be set: 2017.Pp 2018.Bl -tag -width xxxx -compact 2019.It Ar max-src-nodes <number> 2020Limits the maximum number of source addresses which can simultaneously 2021have state table entries. 2022.It Ar max-src-states <number> 2023Limits the maximum number of simultaneous state entries that a single 2024source address can create with this rule. 2025.El 2026.Pp 2027For stateful TCP connections, limits on established connections (connections 2028which have completed the TCP 3-way handshake) can also be enforced 2029per source IP. 2030.Pp 2031.Bl -tag -width xxxx -compact 2032.It Ar max-src-conn <number> 2033Limits the maximum number of simultaneous TCP connections which have 2034completed the 3-way handshake that a single host can make. 2035.It Ar max-src-conn-rate <number> / <seconds> 2036Limit the rate of new connections over a time interval. 2037The connection rate is an approximation calculated as a moving average. 2038.El 2039.Pp 2040Because the 3-way handshake ensures that the source address is not being 2041spoofed, more aggressive action can be taken based on these limits. 2042With the 2043.Ar overload <table> 2044state option, source IP addresses which hit either of the limits on 2045established connections will be added to the named table. 2046This table can be used in the ruleset to block further activity from 2047the offending host, redirect it to a tarpit process, or restrict its 2048bandwidth. 2049.Pp 2050The optional 2051.Ar flush 2052keyword kills all states created by the matching rule which originate 2053from the host which exceeds these limits. 2054The 2055.Ar global 2056modifier to the flush command kills all states originating from the 2057offending host, regardless of which rule created the state. 2058.Pp 2059For example, the following rules will protect the webserver against 2060hosts making more than 100 connections in 10 seconds. 2061Any host which connects faster than this rate will have its address added 2062to the <bad_hosts> table and have all states originating from it flushed. 2063Any new packets arriving from this host will be dropped unconditionally 2064by the block rule. 2065.Bd -literal -offset indent 2066block quick from <bad_hosts> 2067pass in on $ext_if proto tcp to $webserver port www flags S/SA keep state \e 2068 (max-src-conn-rate 100/10, overload <bad_hosts> flush global) 2069.Ed 2070.Sh OPERATING SYSTEM FINGERPRINTING 2071Passive OS Fingerprinting is a mechanism to inspect nuances of a TCP 2072connection's initial SYN packet and guess at the host's operating system. 2073Unfortunately these nuances are easily spoofed by an attacker so the 2074fingerprint is not useful in making security decisions. 2075But the fingerprint is typically accurate enough to make policy decisions 2076upon. 2077.Pp 2078The fingerprints may be specified by operating system class, by 2079version, or by subtype/patchlevel. 2080The class of an operating system is typically the vendor or genre 2081and would be OpenBSD for the 2082.Xr pf 4 2083firewall itself. 2084The version of the oldest available OpenBSD release on the main ftp site 2085would be 2.6 and the fingerprint would be written 2086.Pp 2087.Dl \&"OpenBSD 2.6\&" 2088.Pp 2089The subtype of an operating system is typically used to describe the 2090patchlevel if that patch led to changes in the TCP stack behavior. 2091In the case of OpenBSD, the only subtype is for a fingerprint that was 2092normalized by the 2093.Ar no-df 2094scrub option and would be specified as 2095.Pp 2096.Dl \&"OpenBSD 3.3 no-df\&" 2097.Pp 2098Fingerprints for most popular operating systems are provided by 2099.Xr pf.os 5 . 2100Once 2101.Xr pf 4 2102is running, a complete list of known operating system fingerprints may 2103be listed by running: 2104.Pp 2105.Dl # pfctl -so 2106.Pp 2107Filter rules can enforce policy at any level of operating system specification 2108assuming a fingerprint is present. 2109Policy could limit traffic to approved operating systems or even ban traffic 2110from hosts that aren't at the latest service pack. 2111.Pp 2112The 2113.Ar unknown 2114class can also be used as the fingerprint which will match packets for 2115which no operating system fingerprint is known. 2116.Pp 2117Examples: 2118.Bd -literal -offset indent 2119pass out proto tcp from any os OpenBSD keep state 2120block out proto tcp from any os Doors 2121block out proto tcp from any os "Doors PT" 2122block out proto tcp from any os "Doors PT SP3" 2123block out from any os "unknown" 2124pass on lo0 proto tcp from any os "OpenBSD 3.3 lo0" keep state 2125.Ed 2126.Pp 2127Operating system fingerprinting is limited only to the TCP SYN packet. 2128This means that it will not work on other protocols and will not match 2129a currently established connection. 2130.Pp 2131Caveat: operating system fingerprints are occasionally wrong. 2132There are three problems: an attacker can trivially craft his packets to 2133appear as any operating system he chooses; 2134an operating system patch could change the stack behavior and no fingerprints 2135will match it until the database is updated; 2136and multiple operating systems may have the same fingerprint. 2137.Sh BLOCKING SPOOFED TRAFFIC 2138"Spoofing" is the faking of IP addresses, typically for malicious 2139purposes. 2140The 2141.Ar antispoof 2142directive expands to a set of filter rules which will block all 2143traffic with a source IP from the network(s) directly connected 2144to the specified interface(s) from entering the system through 2145any other interface. 2146.Pp 2147For example, the line 2148.Bd -literal -offset indent 2149antispoof for lo0 2150.Ed 2151.Pp 2152expands to 2153.Bd -literal -offset indent 2154block drop in on ! lo0 inet from 127.0.0.1/8 to any 2155block drop in on ! lo0 inet6 from ::1 to any 2156.Ed 2157.Pp 2158For non-loopback interfaces, there are additional rules to block incoming 2159packets with a source IP address identical to the interface's IP(s). 2160For example, assuming the interface wi0 had an IP address of 10.0.0.1 and a 2161netmask of 255.255.255.0, 2162the line 2163.Bd -literal -offset indent 2164antispoof for wi0 inet 2165.Ed 2166.Pp 2167expands to 2168.Bd -literal -offset indent 2169block drop in on ! wi0 inet from 10.0.0.0/24 to any 2170block drop in inet from 10.0.0.1 to any 2171.Ed 2172.Pp 2173Caveat: Rules created by the 2174.Ar antispoof 2175directive interfere with packets sent over loopback interfaces 2176to local addresses. 2177One should pass these explicitly. 2178.Sh FRAGMENT HANDLING 2179The size of IP datagrams (packets) can be significantly larger than the 2180maximum transmission unit (MTU) of the network. 2181In cases when it is necessary or more efficient to send such large packets, 2182the large packet will be fragmented into many smaller packets that will each 2183fit onto the wire. 2184Unfortunately for a firewalling device, only the first logical fragment will 2185contain the necessary header information for the subprotocol that allows 2186.Xr pf 4 2187to filter on things such as TCP ports or to perform NAT. 2188.Pp 2189Besides the use of 2190.Ar scrub 2191rules as described in 2192.Sx TRAFFIC NORMALIZATION 2193above, there are three options for handling fragments in the packet filter. 2194.Pp 2195One alternative is to filter individual fragments with filter rules. 2196If no 2197.Ar scrub 2198rule applies to a fragment, it is passed to the filter. 2199Filter rules with matching IP header parameters decide whether the 2200fragment is passed or blocked, in the same way as complete packets 2201are filtered. 2202Without reassembly, fragments can only be filtered based on IP header 2203fields (source/destination address, protocol), since subprotocol header 2204fields are not available (TCP/UDP port numbers, ICMP code/type). 2205The 2206.Ar fragment 2207option can be used to restrict filter rules to apply only to 2208fragments, but not complete packets. 2209Filter rules without the 2210.Ar fragment 2211option still apply to fragments, if they only specify IP header fields. 2212For instance, the rule 2213.Bd -literal -offset indent 2214pass in proto tcp from any to any port 80 2215.Ed 2216.Pp 2217never applies to a fragment, even if the fragment is part of a TCP 2218packet with destination port 80, because without reassembly this information 2219is not available for each fragment. 2220This also means that fragments cannot create new or match existing 2221state table entries, which makes stateful filtering and address 2222translation (NAT, redirection) for fragments impossible. 2223.Pp 2224It's also possible to reassemble only certain fragments by specifying 2225source or destination addresses or protocols as parameters in 2226.Ar scrub 2227rules. 2228.Pp 2229In most cases, the benefits of reassembly outweigh the additional 2230memory cost, and it's recommended to use 2231.Ar scrub 2232rules to reassemble 2233all fragments via the 2234.Ar fragment reassemble 2235modifier. 2236.Pp 2237The memory allocated for fragment caching can be limited using 2238.Xr pfctl 8 . 2239Once this limit is reached, fragments that would have to be cached 2240are dropped until other entries time out. 2241The timeout value can also be adjusted. 2242.Pp 2243Currently, only IPv4 fragments are supported and IPv6 fragments 2244are blocked unconditionally. 2245.Sh ANCHORS 2246Besides the main ruleset, 2247.Xr pfctl 8 2248can load rulesets into 2249.Ar anchor 2250attachment points. 2251An 2252.Ar anchor 2253is a container that can hold rules, address tables, and other anchors. 2254.Pp 2255An 2256.Ar anchor 2257has a name which specifies the path where 2258.Xr pfctl 8 2259can be used to access the anchor to perform operations on it, such as 2260attaching child anchors to it or loading rules into it. 2261Anchors may be nested, with components separated by 2262.Sq / 2263characters, similar to how file system hierarchies are laid out. 2264The main ruleset is actually the default anchor, so filter and 2265translation rules, for example, may also be contained in any anchor. 2266.Pp 2267An anchor can reference another 2268.Ar anchor 2269attachment point 2270using the following kinds 2271of rules: 2272.Bl -tag -width xxxx 2273.It Ar nat-anchor <name> 2274Evaluates the 2275.Ar nat 2276rules in the specified 2277.Ar anchor . 2278.It Ar rdr-anchor <name> 2279Evaluates the 2280.Ar rdr 2281rules in the specified 2282.Ar anchor . 2283.It Ar binat-anchor <name> 2284Evaluates the 2285.Ar binat 2286rules in the specified 2287.Ar anchor . 2288.It Ar anchor <name> 2289Evaluates the filter rules in the specified 2290.Ar anchor . 2291.It Ar load anchor <name> from <file> 2292Loads the rules from the specified file into the 2293anchor 2294.Ar name . 2295.El 2296.Pp 2297When evaluation of the main ruleset reaches an 2298.Ar anchor 2299rule, 2300.Xr pf 4 2301will proceed to evaluate all rules specified in that anchor. 2302.Pp 2303Matching filter and translation rules in anchors with the 2304.Ar quick 2305option are final and abort the evaluation of the rules in other 2306anchors 2307and the main ruleset. 2308.Pp 2309.Ar anchor 2310rules are evaluated relative to the anchor in which they are contained. 2311For example, all 2312.Ar anchor 2313rules specified in the main ruleset will reference anchor 2314attachment points underneath the main ruleset, and 2315.Ar anchor 2316rules specified in a file loaded from a 2317.Ar load anchor 2318rule will be attached under that anchor point. 2319.Pp 2320Rules may be contained in 2321.Ar anchor 2322attachment points which do not contain any rules when the main ruleset 2323is loaded, and later such anchors can be manipulated through 2324.Xr pfctl 8 2325without reloading the main ruleset or other anchors. 2326For example, 2327.Bd -literal -offset indent 2328ext_if = \&"kue0\&" 2329block on $ext_if all 2330anchor spam 2331pass out on $ext_if all keep state 2332pass in on $ext_if proto tcp from any \e 2333 to $ext_if port smtp keep state 2334.Ed 2335.Pp 2336blocks all packets on the external interface by default, then evaluates 2337all rules in the 2338.Ar anchor 2339named "spam", and finally passes all outgoing connections and 2340incoming connections to port 25. 2341.Bd -literal -offset indent 2342# echo \&"block in quick from 1.2.3.4 to any\&" \&| \e 2343 pfctl -a spam -f - 2344.Ed 2345.Pp 2346This loads a single rule into the 2347.Ar anchor , 2348which blocks all packets from a specific address. 2349.Pp 2350The anchor can also be populated by adding a 2351.Ar load anchor 2352rule after the 2353.Ar anchor 2354rule: 2355.Bd -literal -offset indent 2356anchor spam 2357load anchor spam from "/etc/pf-spam.conf" 2358.Ed 2359.Pp 2360When 2361.Xr pfctl 8 2362loads 2363.Nm pf.conf , 2364it will also load all the rules from the file 2365.Pa /etc/pf-spam.conf 2366into the anchor. 2367.Pp 2368Optionally, 2369.Ar anchor 2370rules can specify the parameter's 2371direction, interface, address family, protocol and source/destination 2372address/port 2373using the same syntax as filter rules. 2374When parameters are used, the 2375.Ar anchor 2376rule is only evaluated for matching packets. 2377This allows conditional evaluation of anchors, like: 2378.Bd -literal -offset indent 2379block on $ext_if all 2380anchor spam proto tcp from any to any port smtp 2381pass out on $ext_if all keep state 2382pass in on $ext_if proto tcp from any to $ext_if port smtp keep state 2383.Ed 2384.Pp 2385The rules inside 2386.Ar anchor 2387spam are only evaluated for 2388.Ar tcp 2389packets with destination port 25. 2390Hence, 2391.Bd -literal -offset indent 2392# echo \&"block in quick from 1.2.3.4 to any" \&| \e 2393 pfctl -a spam -f - 2394.Ed 2395.Pp 2396will only block connections from 1.2.3.4 to port 25. 2397.Pp 2398Anchors may end with the asterisk 2399.Pq Sq * 2400character, which signifies that all anchors attached at that point 2401should be evaluated in the alphabetical ordering of their anchor name. 2402For example, 2403.Bd -literal -offset indent 2404anchor "spam/*" 2405.Ed 2406.Pp 2407will evaluate each rule in each anchor attached to the 2408.Li spam 2409anchor. 2410Note that it will only evaluate anchors that are directly attached to the 2411.Li spam 2412anchor, and will not descend to evaluate anchors recursively. 2413.Pp 2414Since anchors are evaluated relative to the anchor in which they are 2415contained, there is a mechanism for accessing the parent and ancestor 2416anchors of a given anchor. 2417Similar to file system path name resolution, if the sequence 2418.Dq .. 2419appears as an anchor path component, the parent anchor of the current 2420anchor in the path evaluation at that point will become the new current 2421anchor. 2422As an example, consider the following: 2423.Bd -literal -offset indent 2424# echo ' anchor "spam/allowed" ' | pfctl -f - 2425# echo -e ' anchor "../banned" \en pass' | \e 2426 pfctl -a spam/allowed -f - 2427.Ed 2428.Pp 2429Evaluation of the main ruleset will lead into the 2430.Li spam/allowed 2431anchor, which will evaluate the rules in the 2432.Li spam/banned 2433anchor, if any, before finally evaluating the 2434.Ar pass 2435rule. 2436.Pp 2437Since the parser specification for anchor names is a string, any 2438reference to an anchor name containing solidus 2439.Pq Sq / 2440characters will require double quote 2441.Pq Sq \&" 2442characters around the anchor name. 2443.Sh TRANSLATION EXAMPLES 2444This example maps incoming requests on port 80 to port 8080, on 2445which a daemon is running (because, for example, it is not run as root, 2446and therefore lacks permission to bind to port 80). 2447.Bd -literal 2448# use a macro for the interface name, so it can be changed easily 2449ext_if = \&"ne3\&" 2450 2451# map daemon on 8080 to appear to be on 80 2452rdr on $ext_if proto tcp from any to any port 80 -> 127.0.0.1 port 8080 2453.Ed 2454.Pp 2455If the 2456.Ar pass 2457modifier is given, packets matching the translation rule are passed without 2458inspecting the filter rules: 2459.Bd -literal 2460rdr pass on $ext_if proto tcp from any to any port 80 -> 127.0.0.1 \e 2461 port 8080 2462.Ed 2463.Pp 2464In the example below, vlan12 is configured as 192.168.168.1; 2465the machine translates all packets coming from 192.168.168.0/24 to 204.92.77.111 2466when they are going out any interface except vlan12. 2467This has the net effect of making traffic from the 192.168.168.0/24 2468network appear as though it is the Internet routable address 2469204.92.77.111 to nodes behind any interface on the router except 2470for the nodes on vlan12. 2471(Thus, 192.168.168.1 can talk to the 192.168.168.0/24 nodes.) 2472.Bd -literal 2473nat on ! vlan12 from 192.168.168.0/24 to any -> 204.92.77.111 2474.Ed 2475.Pp 2476In the example below, the machine sits between a fake internal 144.19.74.* 2477network, and a routable external IP of 204.92.77.100. 2478The 2479.Ar no nat 2480rule excludes protocol AH from being translated. 2481.Bd -literal 2482# NO NAT 2483no nat on $ext_if proto ah from 144.19.74.0/24 to any 2484nat on $ext_if from 144.19.74.0/24 to any -> 204.92.77.100 2485.Ed 2486.Pp 2487In the example below, packets bound for one specific server, as well as those 2488generated by the sysadmins are not proxied; all other connections are. 2489.Bd -literal 2490# NO RDR 2491no rdr on $int_if proto { tcp, udp } from any to $server port 80 2492no rdr on $int_if proto { tcp, udp } from $sysadmins to any port 80 2493rdr on $int_if proto { tcp, udp } from any to any port 80 -> 127.0.0.1 \e 2494 port 80 2495.Ed 2496.Pp 2497This longer example uses both a NAT and a redirection. 2498The external interface has the address 157.161.48.183. 2499On the internal interface, we are running 2500.Xr ftp-proxy 8 , 2501listening for outbound ftp sessions captured to port 8021. 2502.Bd -literal 2503# NAT 2504# Translate outgoing packets' source addresses (any protocol). 2505# In this case, any address but the gateway's external address is mapped. 2506nat on $ext_if inet from ! ($ext_if) to any -> ($ext_if) 2507 2508# NAT PROXYING 2509# Map outgoing packets' source port to an assigned proxy port instead of 2510# an arbitrary port. 2511# In this case, proxy outgoing isakmp with port 500 on the gateway. 2512nat on $ext_if inet proto udp from any port = isakmp to any -> ($ext_if) \e 2513 port 500 2514 2515# BINAT 2516# Translate outgoing packets' source address (any protocol). 2517# Translate incoming packets' destination address to an internal machine 2518# (bidirectional). 2519binat on $ext_if from 10.1.2.150 to any -> $ext_if 2520 2521# RDR 2522# Translate incoming packets' destination addresses. 2523# As an example, redirect a TCP and UDP port to an internal machine. 2524rdr on $ext_if inet proto tcp from any to ($ext_if) port 8080 \e 2525 -> 10.1.2.151 port 22 2526rdr on $ext_if inet proto udp from any to ($ext_if) port 8080 \e 2527 -> 10.1.2.151 port 53 2528 2529# RDR 2530# Translate outgoing ftp control connections to send them to localhost 2531# for proxying with ftp-proxy(8) running on port 8021. 2532rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021 2533.Ed 2534.Pp 2535In this example, a NAT gateway is set up to translate internal addresses 2536using a pool of public addresses (192.0.2.16/28) and to redirect 2537incoming web server connections to a group of web servers on the internal 2538network. 2539.Bd -literal 2540# NAT LOAD BALANCE 2541# Translate outgoing packets' source addresses using an address pool. 2542# A given source address is always translated to the same pool address by 2543# using the source-hash keyword. 2544nat on $ext_if inet from any to any -> 192.0.2.16/28 source-hash 2545 2546# RDR ROUND ROBIN 2547# Translate incoming web server connections to a group of web servers on 2548# the internal network. 2549rdr on $ext_if proto tcp from any to any port 80 \e 2550 -> { 10.1.2.155, 10.1.2.160, 10.1.2.161 } round-robin 2551.Ed 2552.Sh FILTER EXAMPLES 2553.Bd -literal 2554# The external interface is kue0 2555# (157.161.48.183, the only routable address) 2556# and the private network is 10.0.0.0/8, for which we are doing NAT. 2557 2558# use a macro for the interface name, so it can be changed easily 2559ext_if = \&"kue0\&" 2560 2561# normalize all incoming traffic 2562scrub in on $ext_if all fragment reassemble 2563 2564# block and log everything by default 2565block return log on $ext_if all 2566 2567# block anything coming from source we have no back routes for 2568block in from no-route to any 2569 2570# block and log outgoing packets that do not have our address as source, 2571# they are either spoofed or something is misconfigured (NAT disabled, 2572# for instance), we want to be nice and do not send out garbage. 2573block out log quick on $ext_if from ! 157.161.48.183 to any 2574 2575# silently drop broadcasts (cable modem noise) 2576block in quick on $ext_if from any to 255.255.255.255 2577 2578# block and log incoming packets from reserved address space and invalid 2579# addresses, they are either spoofed or misconfigured, we cannot reply to 2580# them anyway (hence, no return-rst). 2581block in log quick on $ext_if from { 10.0.0.0/8, 172.16.0.0/12, \e 2582 192.168.0.0/16, 255.255.255.255/32 } to any 2583 2584# ICMP 2585 2586# pass out/in certain ICMP queries and keep state (ping) 2587# state matching is done on host addresses and ICMP id (not type/code), 2588# so replies (like 0/0 for 8/0) will match queries 2589# ICMP error messages (which always refer to a TCP/UDP packet) are 2590# handled by the TCP/UDP states 2591pass on $ext_if inet proto icmp all icmp-type 8 code 0 keep state 2592 2593# UDP 2594 2595# pass out all UDP connections and keep state 2596pass out on $ext_if proto udp all keep state 2597 2598# pass in certain UDP connections and keep state (DNS) 2599pass in on $ext_if proto udp from any to any port domain keep state 2600 2601# TCP 2602 2603# pass out all TCP connections and modulate state 2604pass out on $ext_if proto tcp all modulate state 2605 2606# pass in certain TCP connections and keep state (SSH, SMTP, DNS, IDENT) 2607pass in on $ext_if proto tcp from any to any port { ssh, smtp, domain, \e 2608 auth } flags S/SA keep state 2609 2610# pass in data mode connections for ftp-proxy running on this host. 2611# (see ftp-proxy(8) for details) 2612pass in on $ext_if proto tcp from any to 157.161.48.183 port >= 49152 \e 2613 flags S/SA keep state 2614 2615# Do not allow Windows 9x SMTP connections since they are typically 2616# a viral worm. Alternately we could limit these OSes to 1 connection each. 2617block in on $ext_if proto tcp from any os {"Windows 95", "Windows 98"} \e 2618 to any port smtp 2619 2620# Packet Tagging 2621 2622# three interfaces: $int_if, $ext_if, and $wifi_if (wireless). NAT is 2623# being done on $ext_if for all outgoing packets. tag packets in on 2624# $int_if and pass those tagged packets out on $ext_if. all other 2625# outgoing packets (i.e., packets from the wireless network) are only 2626# permitted to access port 80. 2627 2628pass in on $int_if from any to any tag INTNET keep state 2629pass in on $wifi_if from any to any keep state 2630 2631block out on $ext_if from any to any 2632pass out quick on $ext_if tagged INTNET keep state 2633pass out on $ext_if proto tcp from any to any port 80 keep state 2634 2635# tag incoming packets as they are redirected to spamd(8). use the tag 2636# to pass those packets through the packet filter. 2637 2638rdr on $ext_if inet proto tcp from <spammers> to port smtp \e 2639 tag SPAMD -> 127.0.0.1 port spamd 2640 2641block in on $ext_if 2642pass in on $ext_if inet proto tcp tagged SPAMD keep state 2643.Ed 2644.Sh GRAMMAR 2645Syntax for 2646.Nm 2647in BNF: 2648.Bd -literal 2649line = ( option | pf-rule | nat-rule | binat-rule | rdr-rule | 2650 antispoof-rule | altq-rule | queue-rule | anchor-rule | 2651 trans-anchors | load-anchors | table-rule ) 2652 2653option = "set" ( [ "timeout" ( timeout | "{" timeout-list "}" ) ] | 2654 [ "optimization" [ "default" | "normal" | 2655 "high-latency" | "satellite" | 2656 "aggressive" | "conservative" ] ] 2657 [ "limit" ( limit-item | "{" limit-list "}" ) ] | 2658 [ "loginterface" ( interface-name | "none" ) ] | 2659 [ "block-policy" ( "drop" | "return" ) ] | 2660 [ "state-policy" ( "if-bound" | "group-bound" | 2661 "floating" ) ] 2662 [ "require-order" ( "yes" | "no" ) ] 2663 [ "fingerprints" filename ] | 2664 [ "debug" ( "none" | "urgent" | "misc" | "loud" ) ] ) 2665 2666pf-rule = action [ ( "in" | "out" ) ] 2667 [ "log" | "log-all" ] [ "quick" ] 2668 [ "on" ifspec ] [ route ] [ af ] [ protospec ] 2669 hosts [ filteropt-list ] 2670 2671filteropt-list = filteropt-list filteropt | filteropt 2672filteropt = user | flags | icmp-type | icmp6-type | tos | 2673 ( "keep" | "modulate" | "synproxy" ) "state" 2674 [ "(" state-opts ")" ] | 2675 "fragment" | "no-df" | "min-ttl" number | 2676 "max-mss" number | "random-id" | "reassemble tcp" | 2677 fragmentation | "allow-opts" | 2678 "label" string | "tag" string | [ ! ] "tagged" string 2679 "queue" ( string | "(" string [ [ "," ] string ] ")" ) | 2680 "probability" number"%" 2681 2682nat-rule = [ "no" ] "nat" [ "pass" ] [ "on" ifspec ] [ af ] 2683 [ protospec ] hosts [ "tag" string ] [ "tagged" string ] 2684 [ "->" ( redirhost | "{" redirhost-list "}" ) 2685 [ portspec ] [ pooltype ] [ "static-port" ] ] 2686 [ ( "if-bound" | "group-bound" | "floating" ) ] 2687 2688binat-rule = [ "no" ] "binat" [ "pass" ] [ "on" interface-name ] 2689 [ af ] [ "proto" ( proto-name | proto-number ) ] 2690 "from" address [ "/" mask-bits ] "to" ipspec 2691 [ "tag" string ] [ "tagged" string ] 2692 [ "->" address [ "/" mask-bits ] ] 2693 2694rdr-rule = [ "no" ] "rdr" [ "pass" ] [ "on" ifspec ] [ af ] 2695 [ protospec ] hosts [ "tag" string ] [ "tagged" string ] 2696 [ "->" ( redirhost | "{" redirhost-list "}" ) 2697 [ portspec ] [ pooltype ] ] 2698 [ ( "if-bound" | "group-bound" | "floating" ) ] 2699 2700antispoof-rule = "antispoof" [ "log" ] [ "quick" ] 2701 "for" ( interface-name | "{" interface-list "}" ) 2702 [ af ] [ "label" string ] 2703 2704table-rule = "table" "<" string ">" [ tableopts-list ] 2705tableopts-list = tableopts-list tableopts | tableopts 2706tableopts = "persist" | "const" | "file" string | 2707 "{" [ tableaddr-list ] "}" 2708tableaddr-list = tableaddr-list [ "," ] tableaddr-spec | tableaddr-spec 2709tableaddr-spec = [ "!" ] tableaddr [ "/" mask-bits ] 2710tableaddr = hostname | ipv4-dotted-quad | ipv6-coloned-hex | 2711 interface-name | "self" 2712 2713altq-rule = "altq on" interface-name queueopts-list 2714 "queue" subqueue 2715queue-rule = "queue" string [ "on" interface-name ] queueopts-list 2716 subqueue 2717 2718anchor-rule = "anchor" string [ ( "in" | "out" ) ] [ "on" ifspec ] 2719 [ af ] [ "proto" ] [ protospec ] [ hosts ] 2720 2721trans-anchors = ( "nat-anchor" | "rdr-anchor" | "binat-anchor" ) string 2722 [ "on" ifspec ] [ af ] [ "proto" ] [ protospec ] [ hosts ] 2723 2724load-anchor = "load anchor" string "from" filename 2725 2726queueopts-list = queueopts-list queueopts | queueopts 2727queueopts = [ "bandwidth" bandwidth-spec ] | 2728 [ "qlimit" number ] | [ "tbrsize" number ] | 2729 [ "priority" number ] | [ schedulers ] 2730schedulers = ( cbq-def | priq-def | hfsc-def ) 2731bandwidth-spec = "number" ( "b" | "Kb" | "Mb" | "Gb" | "%" ) 2732 2733action = "pass" | "block" [ return ] | [ "no" ] "scrub" 2734return = "drop" | "return" | "return-rst" [ "( ttl" number ")" ] | 2735 "return-icmp" [ "(" icmpcode [ [ "," ] icmp6code ] ")" ] | 2736 "return-icmp6" [ "(" icmp6code ")" ] 2737icmpcode = ( icmp-code-name | icmp-code-number ) 2738icmp6code = ( icmp6-code-name | icmp6-code-number ) 2739 2740ifspec = ( [ "!" ] interface-name ) | "{" interface-list "}" 2741interface-list = [ "!" ] interface-name [ [ "," ] interface-list ] 2742route = "fastroute" | 2743 ( "route-to" | "reply-to" | "dup-to" ) 2744 ( routehost | "{" routehost-list "}" ) 2745 [ pooltype ] 2746af = "inet" | "inet6" 2747 2748protospec = "proto" ( proto-name | proto-number | 2749 "{" proto-list "}" ) 2750proto-list = ( proto-name | proto-number ) [ [ "," ] proto-list ] 2751 2752hosts = "all" | 2753 "from" ( "any" | "no-route" | "self" | host | 2754 "{" host-list "}" | "route" string ) [ port ] [ os ] 2755 "to" ( "any" | "no-route" | "self" | host | 2756 "{" host-list "}" | "route" string ) [ port ] 2757 2758ipspec = "any" | host | "{" host-list "}" 2759host = [ "!" ] ( address [ "/" mask-bits ] | "<" string ">" ) 2760redirhost = address [ "/" mask-bits ] 2761routehost = ( interface-name [ address [ "/" mask-bits ] ] ) 2762address = ( interface-name | "(" interface-name ")" | hostname | 2763 ipv4-dotted-quad | ipv6-coloned-hex ) 2764host-list = host [ [ "," ] host-list ] 2765redirhost-list = redirhost [ [ "," ] redirhost-list ] 2766routehost-list = routehost [ [ "," ] routehost-list ] 2767 2768port = "port" ( unary-op | binary-op | "{" op-list "}" ) 2769portspec = "port" ( number | name ) [ ":" ( "*" | number | name ) ] 2770os = "os" ( os-name | "{" os-list "}" ) 2771user = "user" ( unary-op | binary-op | "{" op-list "}" ) 2772.\" group = "group" ( unary-op | binary-op | "{" op-list "}" ) 2773 2774unary-op = [ "=" | "!=" | "<" | "<=" | ">" | ">=" ] 2775 ( name | number ) 2776binary-op = number ( "<>" | "><" | ":" ) number 2777op-list = ( unary-op | binary-op ) [ [ "," ] op-list ] 2778 2779os-name = operating-system-name 2780os-list = os-name [ [ "," ] os-list ] 2781 2782flags = "flags" [ flag-set ] "/" flag-set 2783flag-set = [ "F" ] [ "S" ] [ "R" ] [ "P" ] [ "A" ] [ "U" ] [ "E" ] 2784 [ "W" ] 2785 2786icmp-type = "icmp-type" ( icmp-type-code | "{" icmp-list "}" ) 2787icmp6-type = "icmp6-type" ( icmp-type-code | "{" icmp-list "}" ) 2788icmp-type-code = ( icmp-type-name | icmp-type-number ) 2789 [ "code" ( icmp-code-name | icmp-code-number ) ] 2790icmp-list = icmp-type-code [ [ "," ] icmp-list ] 2791 2792tos = "tos" ( "lowdelay" | "throughput" | "reliability" | 2793 [ "0x" ] number ) 2794 2795state-opts = state-opt [ [ "," ] state-opts ] 2796state-opt = ( "max" number | timeout | 2797 "source-track" [ ( "rule" | "global" ) ] | 2798 "max-src-nodes" number | "max-src-states" number | 2799 "max-src-conn" number | 2800 "max-src-conn-rate" number "/" number | 2801 "overload" "<" string ">" [ "flush" ] | 2802 "if-bound" | "group-bound" | "floating" ) 2803 2804fragmentation = [ "fragment reassemble" | "fragment crop" | 2805 "fragment drop-ovl" ] 2806 2807timeout-list = timeout [ [ "," ] timeout-list ] 2808timeout = ( "tcp.first" | "tcp.opening" | "tcp.established" | 2809 "tcp.closing" | "tcp.finwait" | "tcp.closed" | 2810 "udp.first" | "udp.single" | "udp.multiple" | 2811 "icmp.first" | "icmp.error" | 2812 "other.first" | "other.single" | "other.multiple" | 2813 "frag" | "interval" | "src.track" | 2814 "adaptive.start" | "adaptive.end" ) number 2815 2816limit-list = limit-item [ [ "," ] limit-list ] 2817limit-item = ( "states" | "frags" | "src-nodes" ) number 2818 2819pooltype = ( "bitmask" | "random" | 2820 "source-hash" [ ( hex-key | string-key ) ] | 2821 "round-robin" ) [ sticky-address ] 2822 2823subqueue = string | "{" queue-list "}" 2824queue-list = string [ [ "," ] string ] 2825cbq-def = "cbq" [ "(" cbq-opt [ [ "," ] cbq-opt ] ")" ] 2826priq-def = "priq" [ "(" priq-opt [ [ "," ] priq-opt ] ")" ] 2827hfsc-def = "hfsc" [ "(" hfsc-opt [ [ "," ] hfsc-opt ] ")" ] 2828cbq-opt = ( "default" | "borrow" | "red" | "ecn" | "rio" ) 2829priq-opt = ( "default" | "red" | "ecn" | "rio" ) 2830hfsc-opt = ( "default" | "red" | "ecn" | "rio" | 2831 linkshare-sc | realtime-sc | upperlimit-sc ) 2832linkshare-sc = "linkshare" sc-spec 2833realtime-sc = "realtime" sc-spec 2834upperlimit-sc = "upperlimit" sc-spec 2835sc-spec = ( bandwidth-spec | 2836 "(" bandwidth-spec number bandwidth-spec ")" ) 2837.Ed 2838.Sh FILES 2839.Bl -tag -width "/etc/protocols" -compact 2840.It Pa /etc/hosts 2841Host name database. 2842.It Pa /etc/pf.conf 2843Default location of the ruleset file. 2844.It Pa /etc/pf.os 2845Default location of OS fingerprints. 2846.It Pa /etc/protocols 2847Protocol name database. 2848.It Pa /etc/services 2849Service name database. 2850.It Pa /usr/share/examples/pf 2851Example rulesets. 2852.El 2853.Sh SEE ALSO 2854.Xr icmp 4 , 2855.Xr icmp6 4 , 2856.Xr ip 4 , 2857.Xr ip6 4 , 2858.Xr pf 4 , 2859.\" .Xr pfsync 4 , 2860.Xr route 4 , 2861.Xr tcp 4 , 2862.Xr udp 4 , 2863.Xr hosts 5 , 2864.Xr pf.os 5 , 2865.Xr protocols 5 , 2866.Xr services 5 , 2867.Xr ftp-proxy 8 , 2868.Xr pfctl 8 , 2869.Xr pflogd 8 , 2870.Xr route 8 2871.Sh HISTORY 2872The 2873.Nm 2874file format first appeared in 2875.Ox 3.0 . 2876