1.\" $NetBSD: pf.conf.5,v 1.12 2007/12/03 18:19:08 wiz Exp $ 2.\" $OpenBSD: pf.conf.5,v 1.326 2005/03/01 18:10:44 jmc Exp $ 3.\" 4.\" Copyright (c) 2002, Daniel Hartmeier 5.\" All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 11.\" - Redistributions of source code must retain the above copyright 12.\" notice, this list of conditions and the following disclaimer. 13.\" - Redistributions in binary form must reproduce the above 14.\" copyright notice, this list of conditions and the following 15.\" disclaimer in the documentation and/or other materials provided 16.\" with the distribution. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19.\" "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 20.\" LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 21.\" FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 22.\" COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 23.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 24.\" BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 25.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 26.\" CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 28.\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29.\" POSSIBILITY OF SUCH DAMAGE. 30.\" 31.Dd April 26, 2006 32.Dt PF.CONF 5 33.Os 34.Sh NAME 35.Nm pf.conf 36.Nd packet filter configuration file 37.Sh DESCRIPTION 38The 39.Xr pf 4 40packet filter modifies, drops or passes packets according to rules or 41definitions specified in 42.Nm pf.conf . 43.Sh STATEMENT ORDER 44There are seven types of statements in 45.Nm pf.conf : 46.Bl -tag -width xxxx 47.It Cm Macros 48User-defined variables may be defined and used later, simplifying 49the configuration file. 50Macros must be defined before they are referenced in 51.Nm pf.conf . 52.It Cm Tables 53Tables provide a mechanism for increasing the performance and flexibility of 54rules with large numbers of source or destination addresses. 55.It Cm Options 56Options tune the behaviour of the packet filtering engine. 57.It Cm Traffic Normalization Li (e.g. Em scrub ) 58Traffic normalization protects internal machines against inconsistencies 59in Internet protocols and implementations. 60.It Cm Queueing 61Queueing provides rule-based bandwidth control. 62.It Cm Translation Li (Various forms of NAT) 63Translation rules specify how addresses are to be mapped or redirected to 64other addresses. 65.It Cm Packet Filtering 66Stateful and stateless packet filtering provides rule-based blocking or 67passing of packets. 68.El 69.Pp 70With the exception of 71.Cm macros 72and 73.Cm tables , 74the types of statements should be grouped and appear in 75.Nm pf.conf 76in the order shown above, as this matches the operation of the underlying 77packet filtering engine. 78By default 79.Xr pfctl 8 80enforces this order (see 81.Ar set require-order 82below). 83.Sh MACROS 84Much like 85.Xr cpp 1 86or 87.Xr m4 1 , 88macros can be defined that will later be expanded in context. 89Macro names must start with a letter, and may contain letters, digits 90and underscores. 91Macro names may not be reserved words (for example 92.Ar pass , 93.Ar in , 94.Ar out ) . 95Macros are not expanded inside quotes. 96.Pp 97For example, 98.Bd -literal -offset indent 99ext_if = \&"kue0\&" 100all_ifs = \&"{\&" $ext_if lo0 \&"}\&" 101pass out on $ext_if from any to any keep state 102pass in on $ext_if proto tcp from any to any port 25 keep state 103.Ed 104.Sh TABLES 105Tables are named structures which can hold a collection of addresses and 106networks. 107Lookups against tables in 108.Xr pf 4 109are relatively fast, making a single rule with tables much more efficient, 110in terms of 111processor usage and memory consumption, than a large number of rules which 112differ only in IP address (either created explicitly or automatically by rule 113expansion). 114.Pp 115Tables can be used as the source or destination of filter rules, 116.Ar scrub 117rules 118or 119translation rules such as 120.Ar nat 121or 122.Ar rdr 123(see below for details on the various rule types). 124Tables can also be used for the redirect address of 125.Ar nat 126and 127.Ar rdr 128rules and in the routing options of filter rules, but only for 129.Ar round-robin 130pools. 131.Pp 132Tables can be defined with any of the following 133.Xr pfctl 8 134mechanisms. 135As with macros, reserved words may not be used as table names. 136.Bl -tag -width "manually" 137.It Ar manually 138Persistent tables can be manually created with the 139.Ar add 140or 141.Ar replace 142option of 143.Xr pfctl 8 , 144before or after the ruleset has been loaded. 145.It Pa pf.conf 146Table definitions can be placed directly in this file, and loaded at the 147same time as other rules are loaded, atomically. 148Table definitions inside 149.Nm pf.conf 150use the 151.Ar table 152statement, and are especially useful to define non-persistent tables. 153The contents of a pre-existing table defined without a list of addresses 154to initialize it is not altered when 155.Nm pf.conf 156is loaded. 157A table initialized with the empty list, 158.Li { } , 159will be cleared on load. 160.El 161.Pp 162Tables may be defined with the following two attributes: 163.Bl -tag -width persist 164.It Ar persist 165The 166.Ar persist 167flag forces the kernel to keep the table even when no rules refer to it. 168If the flag is not set, the kernel will automatically remove the table 169when the last rule referring to it is flushed. 170.It Ar const 171The 172.Ar const 173flag prevents the user from altering the contents of the table once it 174has been created. 175Without that flag, 176.Xr pfctl 8 177can be used to add or remove addresses from the table at any time, even 178when running with securelevel = 2. 179.El 180.Pp 181For example, 182.Bd -literal -offset indent 183table <private> const { 10/8, 172.16/12, 192.168/16 } 184table <badhosts> persist 185block on fxp0 from { <private>, <badhosts> } to any 186.Ed 187.Pp 188creates a table called private, to hold RFC 1918 private network 189blocks, and a table called badhosts, which is initially empty. 190A filter rule is set up to block all traffic coming from addresses listed in 191either table. 192The private table cannot have its contents changed and the badhosts table 193will exist even when no active filter rules reference it. 194Addresses may later be added to the badhosts table, so that traffic from 195these hosts can be blocked by using 196.Bd -literal -offset indent 197# pfctl -t badhosts -Tadd 204.92.77.111 198.Ed 199.Pp 200A table can also be initialized with an address list specified in one or more 201external files, using the following syntax: 202.Bd -literal -offset indent 203table <spam> persist file \&"/etc/spammers\&" file \&"/etc/openrelays\&" 204block on fxp0 from <spam> to any 205.Ed 206.Pp 207The files 208.Pa /etc/spammers 209and 210.Pa /etc/openrelays 211list IP addresses, one per line. 212Any lines beginning with a # are treated as comments and ignored. 213In addition to being specified by IP address, hosts may also be 214specified by their hostname. 215When the resolver is called to add a hostname to a table, 216.Em all 217resulting IPv4 and IPv6 addresses are placed into the table. 218IP addresses can also be entered in a table by specifying a valid interface 219name or the 220.Em self 221keyword, in which case all addresses assigned to the interface(s) will be 222added to the table. 223.Sh OPTIONS 224.Xr pf 4 225may be tuned for various situations using the 226.Ar set 227command. 228.Bl -tag -width xxxx 229.It Ar set timeout 230.Pp 231.Bl -tag -width "src.track" -compact 232.It Ar interval 233Interval between purging expired states and fragments. 234.It Ar frag 235Seconds before an unassembled fragment is expired. 236.It Ar src.track 237Length of time to retain a source tracking entry after the last state 238expires. 239.El 240.Pp 241When a packet matches a stateful connection, the seconds to live for the 242connection will be updated to that of the 243.Ar proto.modifier 244which corresponds to the connection state. 245Each packet which matches this state will reset the TTL. 246Tuning these values may improve the performance of the 247firewall at the risk of dropping valid idle connections. 248.Pp 249.Bl -tag -width xxxx -compact 250.It Ar tcp.first 251The state after the first packet. 252.It Ar tcp.opening 253The state before the destination host ever sends a packet. 254.It Ar tcp.established 255The fully established state. 256.It Ar tcp.closing 257The state after the first FIN has been sent. 258.It Ar tcp.finwait 259The state after both FINs have been exchanged and the connection is closed. 260Some hosts (notably web servers on Solaris) send TCP packets even after closing 261the connection. 262Increasing 263.Ar tcp.finwait 264(and possibly 265.Ar tcp.closing ) 266can prevent blocking of such packets. 267.It Ar tcp.closed 268The state after one endpoint sends an RST. 269.El 270.Pp 271ICMP and UDP are handled in a fashion similar to TCP, but with a much more 272limited set of states: 273.Pp 274.Bl -tag -width xxxx -compact 275.It Ar udp.first 276The state after the first packet. 277.It Ar udp.single 278The state if the source host sends more than one packet but the destination 279host has never sent one back. 280.It Ar udp.multiple 281The state if both hosts have sent packets. 282.It Ar icmp.first 283The state after the first packet. 284.It Ar icmp.error 285The state after an ICMP error came back in response to an ICMP packet. 286.El 287.Pp 288Other protocols are handled similarly to UDP: 289.Pp 290.Bl -tag -width xxxx -compact 291.It Ar other.first 292.It Ar other.single 293.It Ar other.multiple 294.El 295.Pp 296Timeout values can be reduced adaptively as the number of state table 297entries grows. 298.Pp 299.Bl -tag -width xxxx -compact 300.It Ar adaptive.start 301When the number of state entries exceeds this value, adaptive scaling 302begins. 303All timeout values are scaled linearly with factor 304(adaptive.end - number of states) / (adaptive.end - adaptive.start). 305.It Ar adaptive.end 306When reaching this number of state entries, all timeout values become 307zero, effectively purging all state entries immediately. 308This value is used to define the scale factor, it should not actually 309be reached (set a lower state limit, see below). 310.El 311.Pp 312These values can be defined both globally and for each rule. 313When used on a per-rule basis, the values relate to the number of 314states created by the rule, otherwise to the total number of 315states. 316.Pp 317For example: 318.Bd -literal -offset indent 319set timeout tcp.first 120 320set timeout tcp.established 86400 321set timeout { adaptive.start 6000, adaptive.end 12000 } 322set limit states 10000 323.Ed 324.Pp 325With 9000 state table entries, the timeout values are scaled to 50% 326(tcp.first 60, tcp.established 43200). 327.Pp 328.It Ar set loginterface 329Enable collection of packet and byte count statistics for the given interface. 330These statistics can be viewed using 331.Bd -literal -offset indent 332# pfctl -s info 333.Ed 334.Pp 335In this example 336.Xr pf 4 337collects statistics on the interface named dc0: 338.Bd -literal -offset indent 339set loginterface dc0 340.Ed 341.Pp 342One can disable the loginterface using: 343.Bd -literal -offset indent 344set loginterface none 345.Ed 346.Pp 347.It Ar set limit 348Sets hard limits on the memory pools used by the packet filter. 349See 350.Xr pool 9 351for an explanation of memory pools. 352.Pp 353For example, 354.Bd -literal -offset indent 355set limit states 20000 356.Ed 357.Pp 358sets the maximum number of entries in the memory pool used by state table 359entries (generated by 360.Ar keep state 361rules) to 20000. 362Using 363.Bd -literal -offset indent 364set limit frags 20000 365.Ed 366.Pp 367sets the maximum number of entries in the memory pool used for fragment 368reassembly (generated by 369.Ar scrub 370rules) to 20000. 371Finally, 372.Bd -literal -offset indent 373set limit src-nodes 2000 374.Ed 375.Pp 376sets the maximum number of entries in the memory pool used for tracking 377source IP addresses (generated by the 378.Ar sticky-address 379and 380.Ar source-track 381options) to 2000. 382.Pp 383These can be combined: 384.Bd -literal -offset indent 385set limit { states 20000, frags 20000, src-nodes 2000 } 386.Ed 387.Pp 388.It Ar set optimization 389Optimize the engine for one of the following network environments: 390.Pp 391.Bl -tag -width xxxx -compact 392.It Ar normal 393A normal network environment. 394Suitable for almost all networks. 395.It Ar high-latency 396A high-latency environment (such as a satellite connection). 397.It Ar satellite 398Alias for 399.Ar high-latency . 400.It Ar aggressive 401Aggressively expire connections. 402This can greatly reduce the memory usage of the firewall at the cost of 403dropping idle connections early. 404.It Ar conservative 405Extremely conservative settings. 406Avoid dropping legitimate connections at the 407expense of greater memory utilization (possibly much greater on a busy 408network) and slightly increased processor utilization. 409.El 410.Pp 411For example: 412.Bd -literal -offset indent 413set optimization aggressive 414.Ed 415.Pp 416.It Ar set block-policy 417The 418.Ar block-policy 419option sets the default behaviour for the packet 420.Ar block 421action: 422.Pp 423.Bl -tag -width xxxxxxxx -compact 424.It Ar drop 425Packet is silently dropped. 426.It Ar return 427A TCP RST is returned for blocked TCP packets, 428an ICMP UNREACHABLE is returned for blocked UDP packets, 429and all other packets are silently dropped. 430.El 431.Pp 432For example: 433.Bd -literal -offset indent 434set block-policy return 435.Ed 436.It Ar set state-policy 437The 438.Ar state-policy 439option sets the default behaviour for states: 440.Pp 441.Bl -tag -width group-bound -compact 442.It Ar if-bound 443States are bound to interface. 444.It Ar group-bound 445States are bound to interface group (i.e. ppp) 446.It Ar floating 447States can match packets on any interfaces (the default). 448.El 449.Pp 450For example: 451.Bd -literal -offset indent 452set state-policy if-bound 453.Ed 454.It Ar set require-order 455By default 456.Xr pfctl 8 457enforces an ordering of the statement types in the ruleset to: 458.Em options , 459.Em normalization , 460.Em queueing , 461.Em translation , 462.Em filtering . 463Setting this option to 464.Ar no 465disables this enforcement. 466There may be non-trivial and non-obvious implications to an out of 467order ruleset. 468Consider carefully before disabling the order enforcement. 469.It Ar set fingerprints 470Load fingerprints of known operating systems from the given filename. 471By default fingerprints of known operating systems are automatically 472loaded from 473.Xr pf.os 5 474in 475.Pa /etc 476but can be overridden via this option. 477Setting this option may leave a small period of time where the fingerprints 478referenced by the currently active ruleset are inconsistent until the new 479ruleset finishes loading. 480.Pp 481For example: 482.Pp 483.Dl set fingerprints \&"/etc/pf.os.devel\&" 484.Pp 485.It Ar set skip on <ifspec> 486List interfaces for which packets should not be filtered. 487Packets passing in or out on such interfaces are passed as if pf was 488disabled, i.e. pf does not process them in any way. 489This can be useful on loopback and other virtual interfaces, when 490packet filtering is not desired and can have unexpected effects. 491For example: 492.Pp 493.Dl set skip on lo0 494.Pp 495.It Ar set debug 496Set the debug 497.Ar level 498to one of the following: 499.Pp 500.Bl -tag -width xxxxxxxxxxxx -compact 501.It Ar none 502Don't generate debug messages. 503.It Ar urgent 504Generate debug messages only for serious errors. 505.It Ar misc 506Generate debug messages for various errors. 507.It Ar loud 508Generate debug messages for common conditions. 509.El 510.El 511.Sh TRAFFIC NORMALIZATION 512Traffic normalization is used to sanitize packet content in such 513a way that there are no ambiguities in packet interpretation on 514the receiving side. 515The normalizer does IP fragment reassembly to prevent attacks 516that confuse intrusion detection systems by sending overlapping 517IP fragments. 518Packet normalization is invoked with the 519.Ar scrub 520directive. 521.Pp 522.Ar scrub 523has the following options: 524.Bl -tag -width xxxx 525.It Ar no-df 526Clears the 527.Ar dont-fragment 528bit from a matching IP packet. 529Some operating systems are known to generate fragmented packets with the 530.Ar dont-fragment 531bit set. 532This is particularly true with NFS. 533.Ar Scrub 534will drop such fragmented 535.Ar dont-fragment 536packets unless 537.Ar no-df 538is specified. 539.Pp 540Unfortunately some operating systems also generate their 541.Ar dont-fragment 542packets with a zero IP identification field. 543Clearing the 544.Ar dont-fragment 545bit on packets with a zero IP ID may cause deleterious results if an 546upstream router later fragments the packet. 547Using the 548.Ar random-id 549modifier (see below) is recommended in combination with the 550.Ar no-df 551modifier to ensure unique IP identifiers. 552.It Ar min-ttl <number> 553Enforces a minimum TTL for matching IP packets. 554.It Ar max-mss <number> 555Enforces a maximum MSS for matching TCP packets. 556.It Ar random-id 557Replaces the IP identification field with random values to compensate 558for predictable values generated by many hosts. 559This option only applies to packets that are not fragmented 560after the optional fragment reassembly. 561.It Ar fragment reassemble 562Using 563.Ar scrub 564rules, fragments can be reassembled by normalization. 565In this case, fragments are buffered until they form a complete 566packet, and only the completed packet is passed on to the filter. 567The advantage is that filter rules have to deal only with complete 568packets, and can ignore fragments. 569The drawback of caching fragments is the additional memory cost. 570But the full reassembly method is the only method that currently works 571with NAT. 572This is the default behavior of a 573.Ar scrub 574rule if no fragmentation modifier is supplied. 575.It Ar fragment crop 576The default fragment reassembly method is expensive, hence the option 577to crop is provided. 578In this case, 579.Xr pf 4 580will track the fragments and cache a small range descriptor. 581Duplicate fragments are dropped and overlaps are cropped. 582Thus data will only occur once on the wire with ambiguities resolving to 583the first occurrence. 584Unlike the 585.Ar fragment reassemble 586modifier, fragments are not buffered, they are passed as soon as they 587are received. 588The 589.Ar fragment crop 590reassembly mechanism does not yet work with NAT. 591.Pp 592.It Ar fragment drop-ovl 593This option is similar to the 594.Ar fragment crop 595modifier except that all overlapping or duplicate fragments will be 596dropped, and all further corresponding fragments will be 597dropped as well. 598.It Ar reassemble tcp 599Statefully normalizes TCP connections. 600.Ar scrub reassemble tcp 601rules may not have the direction (in/out) specified. 602.Ar reassemble tcp 603performs the following normalizations: 604.Pp 605.Bl -tag -width timeout -compact 606.It ttl 607Neither side of the connection is allowed to reduce their IP TTL. 608An attacker may send a packet such that it reaches the firewall, affects 609the firewall state, and expires before reaching the destination host. 610.Ar reassemble tcp 611will raise the TTL of all packets back up to the highest value seen on 612the connection. 613.It timestamp modulation 614Modern TCP stacks will send a timestamp on every TCP packet and echo 615the other endpoint's timestamp back to them. 616Many operating systems will merely start the timestamp at zero when 617first booted, and increment it several times a second. 618The uptime of the host can be deduced by reading the timestamp and multiplying 619by a constant. 620Also observing several different timestamps can be used to count hosts 621behind a NAT device. 622And spoofing TCP packets into a connection requires knowing or guessing 623valid timestamps. 624Timestamps merely need to be monotonically increasing and not derived off a 625guessable base time. 626.Ar reassemble tcp 627will cause 628.Ar scrub 629to modulate the TCP timestamps with a random number. 630.It extended PAWS checks 631There is a problem with TCP on long fat pipes, in that a packet might get 632delayed for longer than it takes the connection to wrap its 32-bit sequence 633space. 634In such an occurrence, the old packet would be indistinguishable from a 635new packet and would be accepted as such. 636The solution to this is called PAWS: Protection Against Wrapped Sequence 637numbers. 638It protects against it by making sure the timestamp on each packet does 639not go backwards. 640.Ar reassemble tcp 641also makes sure the timestamp on the packet does not go forward more 642than the RFC allows. 643By doing this, 644.Xr pf 4 645artificially extends the security of TCP sequence numbers by 10 to 18 646bits when the host uses appropriately randomized timestamps, since a 647blind attacker would have to guess the timestamp as well. 648.El 649.El 650.Pp 651For example, 652.Bd -literal -offset indent 653scrub in on $ext_if all fragment reassemble 654.Ed 655.Pp 656The 657.Ar no 658option prefixed to a scrub rule causes matching packets to remain unscrubbed, 659much in the same way as 660.Ar drop quick 661works in the packet filter (see below). 662This mechanism should be used when it is necessary to exclude specific packets 663from broader scrub rules. 664.Sh QUEUEING 665Packets can be assigned to queues for the purpose of bandwidth 666control. 667At least two declarations are required to configure queues, and later 668any packet filtering rule can reference the defined queues by name. 669During the filtering component of 670.Nm pf.conf , 671the last referenced 672.Ar queue 673name is where any packets from 674.Ar pass 675rules will be queued, while for 676.Ar block 677rules it specifies where any resulting ICMP or TCP RST 678packets should be queued. 679The 680.Ar scheduler 681defines the algorithm used to decide which packets get delayed, dropped, or 682sent out immediately. 683There are three 684.Ar schedulers 685currently supported. 686.Bl -tag -width xxxx 687.It Ar cbq 688Class Based Queueing. 689.Ar Queues 690attached to an interface build a tree, thus each 691.Ar queue 692can have further child 693.Ar queues . 694Each queue can have a 695.Ar priority 696and a 697.Ar bandwidth 698assigned. 699.Ar Priority 700mainly controls the time packets take to get sent out, while 701.Ar bandwidth 702has primarily effects on throughput. 703.Ar cbq 704achieves both partitioning and sharing of link bandwidth 705by hierarchically structured classes. 706Each class has its own 707.Ar queue 708and is assigned its share of 709.Ar bandwidth . 710A child class can borrow bandwidth from its parent class 711as long as excess bandwidth is available 712(see the option 713.Ar borrow , 714below). 715.It Ar priq 716Priority Queueing. 717.Ar Queues 718are flat attached to the interface, thus, 719.Ar queues 720cannot have further child 721.Ar queues . 722Each 723.Ar queue 724has a unique 725.Ar priority 726assigned, ranging from 0 to 15. 727Packets in the 728.Ar queue 729with the highest 730.Ar priority 731are processed first. 732.It Ar hfsc 733Hierarchical Fair Service Curve. 734.Ar Queues 735attached to an interface build a tree, thus each 736.Ar queue 737can have further child 738.Ar queues . 739Each queue can have a 740.Ar priority 741and a 742.Ar bandwidth 743assigned. 744.Ar Priority 745mainly controls the time packets take to get sent out, while 746.Ar bandwidth 747has primarily effects on throughput. 748.Ar hfsc 749supports both link-sharing and guaranteed real-time services. 750It employs a service curve based QoS model, 751and its unique feature is an ability to decouple 752.Ar delay 753and 754.Ar bandwidth 755allocation. 756.El 757.Pp 758The interfaces on which queueing should be activated are declared using 759the 760.Ar altq on 761declaration. 762.Ar altq on 763has the following keywords: 764.Bl -tag -width xxxx 765.It Ar <interface> 766Queueing is enabled on the named interface. 767.It Ar <scheduler> 768Specifies which queueing scheduler to use. 769Currently supported values 770are 771.Ar cbq 772for Class Based Queueing, 773.Ar priq 774for Priority Queueing and 775.Ar hfsc 776for the Hierarchical Fair Service Curve scheduler. 777.It Ar bandwidth <bw> 778The maximum bitrate for all queues on an 779interface may be specified using the 780.Ar bandwidth 781keyword. 782The value can be specified as an absolute value or as a 783percentage of the interface bandwidth. 784When using an absolute value, the suffixes 785.Ar b , 786.Ar Kb , 787.Ar Mb , 788and 789.Ar Gb 790are used to represent bits, kilobits, megabits, and 791gigabits per second, respectively. 792The value must not exceed the interface bandwidth. 793If 794.Ar bandwidth 795is not specified, the interface bandwidth is used. 796.It Ar qlimit <limit> 797The maximum number of packets held in the queue. 798The default is 50. 799.It Ar tbrsize <size> 800Adjusts the size, in bytes, of the token bucket regulator. 801If not specified, heuristics based on the 802interface bandwidth are used to determine the size. 803.It Ar queue <list> 804Defines a list of subqueues to create on an interface. 805.El 806.Pp 807In the following example, the interface dc0 808should queue up to 5 Mbit/s in four second-level queues using 809Class Based Queueing. 810Those four queues will be shown in a later example. 811.Bd -literal -offset indent 812altq on dc0 cbq bandwidth 5Mb queue { std, http, mail, ssh } 813.Ed 814.Pp 815Once interfaces are activated for queueing using the 816.Ar altq 817directive, a sequence of 818.Ar queue 819directives may be defined. 820The name associated with a 821.Ar queue 822must match a queue defined in the 823.Ar altq 824directive (e.g. mail), or, except for the 825.Ar priq 826.Ar scheduler , 827in a parent 828.Ar queue 829declaration. 830The following keywords can be used: 831.Bl -tag -width xxxx 832.It Ar on <interface> 833Specifies the interface the queue operates on. 834If not given, it operates on all matching interfaces. 835.It Ar bandwidth <bw> 836Specifies the maximum bitrate to be processed by the queue. 837This value must not exceed the value of the parent 838.Ar queue 839and can be specified as an absolute value or a percentage of the parent 840queue's bandwidth. 841If not specified, defaults to 100% of the parent queue's bandwidth. 842The 843.Ar priq 844scheduler does not support bandwidth specification. 845.It Ar priority <level> 846Between queues a priority level can be set. 847For 848.Ar cbq 849and 850.Ar hfsc , 851the range is 0 to 7 and for 852.Ar priq , 853the range is 0 to 15. 854The default for all is 1. 855.Ar Priq 856queues with a higher priority are always served first. 857.Ar Cbq 858and 859.Ar Hfsc 860queues with a higher priority are preferred in the case of overload. 861.It Ar qlimit <limit> 862The maximum number of packets held in the queue. 863The default is 50. 864.El 865.Pp 866The 867.Ar scheduler 868can get additional parameters with 869.Ar <scheduler> Ns Li (\& Ar <parameters> No ) . 870Parameters are as follows: 871.Bl -tag -width Fl 872.It Ar default 873Packets not matched by another queue are assigned to this one. 874Exactly one default queue is required. 875.It Ar red 876Enable RED (Random Early Detection) on this queue. 877RED drops packets with a probability proportional to the average 878queue length. 879.It Ar rio 880Enables RIO on this queue. 881RIO is RED with IN/OUT, thus running 882RED two times more than RIO would achieve the same effect. 883RIO is currently not supported in the GENERIC kernel. 884.It Ar ecn 885Enables ECN (Explicit Congestion Notification) on this queue. 886ECN implies RED. 887.El 888.Pp 889The 890.Ar cbq 891.Ar scheduler 892supports an additional option: 893.Bl -tag -width Fl 894.It Ar borrow 895The queue can borrow bandwidth from the parent. 896.El 897.Pp 898The 899.Ar hfsc 900.Ar scheduler 901supports some additional options: 902.Bl -tag -width Fl 903.It Ar realtime <sc> 904The minimum required bandwidth for the queue. 905.It Ar upperlimit <sc> 906The maximum allowed bandwidth for the queue. 907.It Ar linkshare <sc> 908The bandwidth share of a backlogged queue. 909.El 910.Pp 911<sc> is an acronym for 912.Ar service curve . 913.Pp 914The format for service curve specifications is 915.Ar ( m1 , d , m2 ) . 916.Ar m2 917controls the bandwidth assigned to the queue. 918.Ar m1 919and 920.Ar d 921are optional and can be used to control the initial bandwidth assignment. 922For the first 923.Ar d 924milliseconds the queue gets the bandwidth given as 925.Ar m1 , 926afterwards the value given in 927.Ar m2 . 928.Pp 929Furthermore, with 930.Ar cbq 931and 932.Ar hfsc , 933child queues can be specified as in an 934.Ar altq 935declaration, thus building a tree of queues using a part of 936their parent's bandwidth. 937.Pp 938Packets can be assigned to queues based on filter rules by using the 939.Ar queue 940keyword. 941Normally only one 942.Ar queue 943is specified; when a second one is specified it will instead be used for 944packets which have a 945.Em TOS 946of 947.Em lowdelay 948and for TCP ACKs with no data payload. 949.Pp 950To continue the previous example, the examples below would specify the 951four referenced 952queues, plus a few child queues. 953Interactive 954.Xr ssh 1 955sessions get priority over bulk transfers like 956.Xr scp 1 957and 958.Xr sftp 1 . 959The queues may then be referenced by filtering rules (see 960.Sx PACKET FILTERING 961below). 962.Bd -literal 963queue std bandwidth 10% cbq(default) 964queue http bandwidth 60% priority 2 cbq(borrow red) \e 965 { employees, developers } 966queue developers bandwidth 75% cbq(borrow) 967queue employees bandwidth 15% 968queue mail bandwidth 10% priority 0 cbq(borrow ecn) 969queue ssh bandwidth 20% cbq(borrow) { ssh_interactive, ssh_bulk } 970queue ssh_interactive bandwidth 50% priority 7 cbq(borrow) 971queue ssh_bulk bandwidth 50% priority 0 cbq(borrow) 972 973block return out on dc0 inet all queue std 974pass out on dc0 inet proto tcp from $developerhosts to any port 80 \e 975 keep state queue developers 976pass out on dc0 inet proto tcp from $employeehosts to any port 80 \e 977 keep state queue employees 978pass out on dc0 inet proto tcp from any to any port 22 \e 979 keep state queue(ssh_bulk, ssh_interactive) 980pass out on dc0 inet proto tcp from any to any port 25 \e 981 keep state queue mail 982.Ed 983.Sh TRANSLATION 984Translation rules modify either the source or destination address of the 985packets associated with a stateful connection. 986A stateful connection is automatically created to track packets matching 987such a rule as long as they are not blocked by the filtering section of 988.Nm pf.conf . 989The translation engine modifies the specified address and/or port in the 990packet, recalculates IP, TCP and UDP checksums as necessary, and passes it to 991the packet filter for evaluation. 992.Pp 993Since translation occurs before filtering the filter 994engine will see packets as they look after any 995addresses and ports have been translated. 996Filter rules will therefore have to filter based on the translated 997address and port number. 998Packets that match a translation rule are only automatically passed if 999the 1000.Ar pass 1001modifier is given, otherwise they are 1002still subject to 1003.Ar block 1004and 1005.Ar pass 1006rules. 1007.Pp 1008The state entry created permits 1009.Xr pf 4 1010to keep track of the original address for traffic associated with that state 1011and correctly direct return traffic for that connection. 1012.Pp 1013Various types of translation are possible with pf: 1014.Bl -tag -width xxxx 1015.It Ar binat 1016A 1017.Ar binat 1018rule specifies a bidirectional mapping between an external IP netblock 1019and an internal IP netblock. 1020.It Ar nat 1021A 1022.Ar nat 1023rule specifies that IP addresses are to be changed as the packet 1024traverses the given interface. 1025This technique allows one or more IP addresses 1026on the translating host to support network traffic for a larger range of 1027machines on an "inside" network. 1028Although in theory any IP address can be used on the inside, it is strongly 1029recommended that one of the address ranges defined by RFC 1918 be used. 1030These netblocks are: 1031.Bd -literal 103210.0.0.0 - 10.255.255.255 (all of net 10, i.e., 10/8) 1033172.16.0.0 - 172.31.255.255 (i.e., 172.16/12) 1034192.168.0.0 - 192.168.255.255 (i.e., 192.168/16) 1035.Ed 1036.It Pa rdr 1037The packet is redirected to another destination and possibly a 1038different port. 1039.Ar rdr 1040rules can optionally specify port ranges instead of single ports. 1041rdr ... port 2000:2999 -> ... port 4000 1042redirects ports 2000 to 2999 (inclusive) to port 4000. 1043rdr ... port 2000:2999 -> ... port 4000:* 1044redirects port 2000 to 4000, 2001 to 4001, ..., 2999 to 4999. 1045.El 1046.Pp 1047In addition to modifying the address, some translation rules may modify 1048source or destination ports for 1049.Xr tcp 4 1050or 1051.Xr udp 4 1052connections; implicitly in the case of 1053.Ar nat 1054rules and explicitly in the case of 1055.Ar rdr 1056rules. 1057Port numbers are never translated with a 1058.Ar binat 1059rule. 1060.Pp 1061For each packet processed by the translator, the translation rules are 1062evaluated in sequential order, from first to last. 1063The first matching rule decides what action is taken. 1064.Pp 1065The 1066.Ar no 1067option prefixed to a translation rule causes packets to remain untranslated, 1068much in the same way as 1069.Ar drop quick 1070works in the packet filter (see below). 1071If no rule matches the packet it is passed to the filter engine unmodified. 1072.Pp 1073Translation rules apply only to packets that pass through 1074the specified interface, and if no interface is specified, 1075translation is applied to packets on all interfaces. 1076For instance, redirecting port 80 on an external interface to an internal 1077web server will only work for connections originating from the outside. 1078Connections to the address of the external interface from local hosts will 1079not be redirected, since such packets do not actually pass through the 1080external interface. 1081Redirections cannot reflect packets back through the interface they arrive 1082on, they can only be redirected to hosts connected to different interfaces 1083or to the firewall itself. 1084.Pp 1085Note that redirecting external incoming connections to the loopback 1086address, as in 1087.Bd -literal -offset indent 1088rdr on ne3 inet proto tcp to port 8025 -> 127.0.0.1 port 25 1089.Ed 1090.Pp 1091will effectively allow an external host to connect to daemons 1092bound solely to the loopback address, circumventing the traditional 1093blocking of such connections on a real interface. 1094Unless this effect is desired, any of the local non-loopback addresses 1095should be used as redirection target instead, which allows external 1096connections only to daemons bound to this address or not bound to 1097any address. 1098.Pp 1099See 1100.Sx TRANSLATION EXAMPLES 1101below. 1102.Sh PACKET FILTERING 1103.Xr pf 4 1104has the ability to 1105.Ar block 1106and 1107.Ar pass 1108packets based on attributes of their layer 3 (see 1109.Xr ip 4 1110and 1111.Xr ip6 4 ) 1112and layer 4 (see 1113.Xr icmp 4 , 1114.Xr icmp6 4 , 1115.Xr tcp 4 , 1116.Xr udp 4 ) 1117headers. 1118In addition, packets may also be 1119assigned to queues for the purpose of bandwidth control. 1120.Pp 1121For each packet processed by the packet filter, the filter rules are 1122evaluated in sequential order, from first to last. 1123The last matching rule decides what action is taken. 1124.Pp 1125The following actions can be used in the filter: 1126.Bl -tag -width xxxx 1127.It Ar block 1128The packet is blocked. 1129There are a number of ways in which a 1130.Ar block 1131rule can behave when blocking a packet. 1132The default behaviour is to 1133.Ar drop 1134packets silently, however this can be overridden or made 1135explicit either globally, by setting the 1136.Ar block-policy 1137option, or on a per-rule basis with one of the following options: 1138.Pp 1139.Bl -tag -width xxxx -compact 1140.It Ar drop 1141The packet is silently dropped. 1142.It Ar return-rst 1143This applies only to 1144.Xr tcp 4 1145packets, and issues a TCP RST which closes the 1146connection. 1147.It Ar return-icmp 1148.It Ar return-icmp6 1149This causes ICMP messages to be returned for packets which match the rule. 1150By default this is an ICMP UNREACHABLE message, however this 1151can be overridden by specifying a message as a code or number. 1152.It Ar return 1153This causes a TCP RST to be returned for 1154.Xr tcp 4 1155packets and an ICMP UNREACHABLE for UDP and other packets. 1156.El 1157.Pp 1158Options returning ICMP packets currently have no effect if 1159.Xr pf 4 1160operates on a 1161.Xr bridge 4 , 1162as the code to support this feature has not yet been implemented. 1163.It Ar pass 1164The packet is passed. 1165.El 1166.Pp 1167If no rule matches the packet, the default action is 1168.Ar pass . 1169.Pp 1170To block everything by default and only pass packets 1171that match explicit rules, one uses 1172.Bd -literal -offset indent 1173block all 1174.Ed 1175.Pp 1176as the first filter rule. 1177.Pp 1178See 1179.Sx FILTER EXAMPLES 1180below. 1181.Sh PARAMETERS 1182The rule parameters specify the packets to which a rule applies. 1183A packet always comes in on, or goes out through, one interface. 1184Most parameters are optional. 1185If a parameter is specified, the rule only applies to packets with 1186matching attributes. 1187Certain parameters can be expressed as lists, in which case 1188.Xr pfctl 8 1189generates all needed rule combinations. 1190.Bl -tag -width xxxx 1191.It Ar in No or Ar out 1192This rule applies to incoming or outgoing packets. 1193If neither 1194.Ar in 1195nor 1196.Ar out 1197are specified, the rule will match packets in both directions. 1198.It Ar log 1199In addition to the action specified, a log message is generated. 1200All packets for that connection are logged, unless the 1201.Ar keep state , 1202.Ar modulate state 1203or 1204.Ar synproxy state 1205options are specified, in which case only the 1206packet that establishes the state is logged. 1207(See 1208.Ar keep state , 1209.Ar modulate state 1210and 1211.Ar synproxy state 1212below). 1213The logged packets are sent to the 1214.Xr pflog 4 1215interface. 1216This interface is monitored by the 1217.Xr pflogd 8 1218logging daemon, which dumps the logged packets to the file 1219.Pa /var/log/pflog 1220in 1221.Xr pcap 3 1222binary format. 1223.It Ar log-all 1224Used with 1225.Ar keep state , 1226.Ar modulate state 1227or 1228.Ar synproxy state 1229rules to force logging of all packets for a connection. 1230As with 1231.Ar log , 1232packets are logged to 1233.Xr pflog 4 . 1234.It Ar quick 1235If a packet matches a rule which has the 1236.Ar quick 1237option set, this rule 1238is considered the last matching rule, and evaluation of subsequent rules 1239is skipped. 1240.It Ar on <interface> 1241This rule applies only to packets coming in on, or going out through, this 1242particular interface. 1243It is also possible to simply give the interface driver name, like ppp or fxp, 1244to make the rule match packets flowing through a group of interfaces. 1245.It Ar <af> 1246This rule applies only to packets of this address family. 1247Supported values are 1248.Ar inet 1249and 1250.Ar inet6 . 1251.It Ar proto <protocol> 1252This rule applies only to packets of this protocol. 1253Common protocols are 1254.Xr icmp 4 , 1255.Xr icmp6 4 , 1256.Xr tcp 4 , 1257and 1258.Xr udp 4 . 1259For a list of all the protocol name to number mappings used by 1260.Xr pfctl 8 , 1261see the file 1262.Em /etc/protocols . 1263.It Xo 1264.Ar from <source> port <source> os <source> 1265.Ar to <dest> port <dest> 1266.Xc 1267This rule applies only to packets with the specified source and destination 1268addresses and ports. 1269.Pp 1270Addresses can be specified in CIDR notation (matching netblocks), as 1271symbolic host names or interface names, or as any of the following keywords: 1272.Pp 1273.Bl -tag -width xxxxxxxxxxxxxx -compact 1274.It Ar any 1275Any address. 1276.It Ar route <label> 1277Any address whose associated route has label 1278.Ar <label> . 1279See 1280.Xr route 4 1281and 1282.Xr route 8 . 1283.It Ar no-route 1284Any address which is not currently routable. 1285.It Ar <table> 1286Any address that matches the given table. 1287.El 1288.Pp 1289Interface names can have modifiers appended: 1290.Pp 1291.Bl -tag -width xxxxxxxxxxxx -compact 1292.It Ar :network 1293Translates to the network(s) attached to the interface. 1294.It Ar :broadcast 1295Translates to the interface's broadcast address(es). 1296.It Ar :peer 1297Translates to the point to point interface's peer address(es). 1298.It Ar :0 1299Do not include interface aliases. 1300.El 1301.Pp 1302Host names may also have the 1303.Ar :0 1304option appended to restrict the name resolution to the first of each 1305v4 and v6 address found. 1306.Pp 1307Host name resolution and interface to address translation are done at 1308ruleset load-time. 1309When the address of an interface (or host name) changes (under DHCP or PPP, 1310for instance), the ruleset must be reloaded for the change to be reflected 1311in the kernel. 1312Surrounding the interface name (and optional modifiers) in parentheses 1313changes this behaviour. 1314When the interface name is surrounded by parentheses, the rule is 1315automatically updated whenever the interface changes its address. 1316The ruleset does not need to be reloaded. 1317This is especially useful with 1318.Ar nat . 1319.Pp 1320Ports can be specified either by number or by name. 1321For example, port 80 can be specified as 1322.Em www . 1323For a list of all port name to number mappings used by 1324.Xr pfctl 8 , 1325see the file 1326.Pa /etc/services . 1327.Pp 1328Ports and ranges of ports are specified by using these operators: 1329.Bd -literal -offset indent 1330= (equal) 1331!= (unequal) 1332< (less than) 1333<= (less than or equal) 1334> (greater than) 1335>= (greater than or equal) 1336: (range including boundaries) 1337>< (range excluding boundaries) 1338<> (except range) 1339.Ed 1340.Pp 1341><, <> and : 1342are binary operators (they take two arguments). 1343For instance: 1344.Bl -tag -width Fl 1345.It Ar port 2000:2004 1346means 1347.Sq all ports >= 2000 and <= 2004 , 1348hence ports 2000, 2001, 2002, 2003 and 2004. 1349.It Ar port 2000 >< 2004 1350means 1351.Sq all ports > 2000 and < 2004 , 1352hence ports 2001, 2002 and 2003. 1353.It Ar port 2000 <> 2004 1354means 1355.Sq all ports < 2000 or > 2004 , 1356hence ports 1-1999 and 2005-65535. 1357.El 1358.Pp 1359The operating system of the source host can be specified in the case of TCP 1360rules with the 1361.Ar OS 1362modifier. 1363See the 1364.Sx OPERATING SYSTEM FINGERPRINTING 1365section for more information. 1366.Pp 1367The host, port and OS specifications are optional, as in the following examples: 1368.Bd -literal -offset indent 1369pass in all 1370pass in from any to any 1371pass in proto tcp from any port <= 1024 to any 1372pass in proto tcp from any to any port 25 1373pass in proto tcp from 10.0.0.0/8 port > 1024 \e 1374 to ! 10.1.2.3 port != ssh 1375pass in proto tcp from any os "OpenBSD" flags S/SA 1376pass in proto tcp from route "DTAG" 1377.Ed 1378.It Ar all 1379This is equivalent to "from any to any". 1380.It Ar group <group> 1381This functionality is not supported in this version of 1382.Nx . 1383.\" Similar to 1384.\" .Ar user , 1385.\" this rule only applies to packets of sockets owned by the specified group. 1386.It Ar user <user> 1387This rule only applies to packets of sockets owned by the specified user. 1388For outgoing connections initiated from the firewall, this is the user 1389that opened the connection. 1390For incoming connections to the firewall itself, this is the user that 1391listens on the destination port. 1392For forwarded connections, where the firewall is not a connection endpoint, 1393the user and group are 1394.Em unknown . 1395.Pp 1396All packets, both outgoing and incoming, of one connection are associated 1397with the same user and group. 1398Only TCP and UDP packets can be associated with users; for other protocols 1399these parameters are ignored. 1400.Pp 1401User and group refer to the effective (as opposed to the real) IDs, in 1402case the socket is created by a setuid/setgid process. 1403User and group IDs are stored when a socket is created; 1404when a process creates a listening socket as root (for instance, by 1405binding to a privileged port) and subsequently changes to another 1406user ID (to drop privileges), the credentials will remain root. 1407.Pp 1408User and group IDs can be specified as either numbers or names. 1409The syntax is similar to the one for ports. 1410The value 1411.Em unknown 1412matches packets of forwarded connections. 1413.Em unknown 1414can only be used with the operators 1415.Cm = 1416and 1417.Cm != . 1418Other constructs like 1419.Cm user >= unknown 1420are invalid. 1421Forwarded packets with unknown user and group ID match only rules 1422that explicitly compare against 1423.Em unknown 1424with the operators 1425.Cm = 1426or 1427.Cm != . 1428For instance 1429.Cm user >= 0 1430does not match forwarded packets. 1431The following example allows only selected users to open outgoing 1432connections: 1433.Bd -literal -offset indent 1434block out proto { tcp, udp } all 1435pass out proto { tcp, udp } all \e 1436 user { < 1000, dhartmei } keep state 1437.Ed 1438.It Ar flags <a>/<b> | /<b> 1439This rule only applies to TCP packets that have the flags 1440.Ar <a> 1441set out of set 1442.Ar <b> . 1443Flags not specified in 1444.Ar <b> 1445are ignored. 1446The flags are: (F)IN, (S)YN, (R)ST, (P)USH, (A)CK, (U)RG, (E)CE, and C(W)R. 1447.Bl -tag -width Fl 1448.It Ar flags S/S 1449Flag SYN is set. 1450The other flags are ignored. 1451.It Ar flags S/SA 1452Out of SYN and ACK, exactly SYN may be set. 1453SYN, SYN+PSH and SYN+RST match, but SYN+ACK, ACK and ACK+RST do not. 1454This is more restrictive than the previous example. 1455.It Ar flags /SFRA 1456If the first set is not specified, it defaults to none. 1457All of SYN, FIN, RST and ACK must be unset. 1458.El 1459.It Ar icmp-type <type> code <code> 1460.It Ar icmp6-type <type> code <code> 1461This rule only applies to ICMP or ICMPv6 packets with the specified type 1462and code. 1463Text names for ICMP types and codes are listed in 1464.Xr icmp 4 1465and 1466.Xr icmp6 4 . 1467This parameter is only valid for rules that cover protocols ICMP or 1468ICMP6. 1469The protocol and the ICMP type indicator 1470.Po 1471.Ar icmp-type 1472or 1473.Ar icmp6-type 1474.Pc 1475must match. 1476.It Xo Ar tos Aq Ar string 1477.No \*(Ba Aq Ar number 1478.Xc 1479This rule applies to packets with the specified 1480.Em TOS 1481bits set. 1482.Em TOS 1483may be 1484given as one of 1485.Ar lowdelay , 1486.Ar throughput , 1487.Ar reliability , 1488or as either hex or decimal. 1489.Pp 1490For example, the following rules are identical: 1491.Bd -literal -offset indent 1492pass all tos lowdelay 1493pass all tos 0x10 1494pass all tos 16 1495.Ed 1496.It Ar allow-opts 1497By default, packets which contain IP options are blocked. 1498When 1499.Ar allow-opts 1500is specified for a 1501.Ar pass 1502rule, packets that pass the filter based on that rule (last matching) 1503do so even if they contain IP options. 1504For packets that match state, the rule that initially created the 1505state is used. 1506The implicit 1507.Ar pass 1508rule that is used when a packet does not match any rules does not 1509allow IP options. 1510.It Ar label <string> 1511Adds a label (name) to the rule, which can be used to identify the rule. 1512For instance, 1513pfctl -s labels 1514shows per-rule statistics for rules that have labels. 1515.Pp 1516The following macros can be used in labels: 1517.Pp 1518.Bl -tag -width $srcaddr -compact -offset indent 1519.It Ar $if 1520The interface. 1521.It Ar $srcaddr 1522The source IP address. 1523.It Ar $dstaddr 1524The destination IP address. 1525.It Ar $srcport 1526The source port specification. 1527.It Ar $dstport 1528The destination port specification. 1529.It Ar $proto 1530The protocol name. 1531.It Ar $nr 1532The rule number. 1533.El 1534.Pp 1535For example: 1536.Bd -literal -offset indent 1537ips = \&"{ 1.2.3.4, 1.2.3.5 }\&" 1538pass in proto tcp from any to $ips \e 1539 port > 1023 label \&"$dstaddr:$dstport\&" 1540.Ed 1541.Pp 1542expands to 1543.Bd -literal -offset indent 1544pass in inet proto tcp from any to 1.2.3.4 \e 1545 port > 1023 label \&"1.2.3.4:>1023\&" 1546pass in inet proto tcp from any to 1.2.3.5 \e 1547 port > 1023 label \&"1.2.3.5:>1023\&" 1548.Ed 1549.Pp 1550The macro expansion for the 1551.Ar label 1552directive occurs only at configuration file parse time, not during runtime. 1553.It Ar queue <queue> | ( <queue> , <queue> ) 1554Packets matching this rule will be assigned to the specified queue. 1555If two queues are given, packets which have a 1556.Em TOS 1557of 1558.Em lowdelay 1559and TCP ACKs with no data payload will be assigned to the second one. 1560See 1561.Sx QUEUEING 1562for setup details. 1563.Pp 1564For example: 1565.Bd -literal -offset indent 1566pass in proto tcp to port 25 queue mail 1567pass in proto tcp to port 22 queue(ssh_bulk, ssh_prio) 1568.Ed 1569.It Ar tag <string> 1570Packets matching this rule will be tagged with the 1571specified string. 1572The tag acts as an internal marker that can be used to 1573identify these packets later on. 1574This can be used, for example, to provide trust between 1575interfaces and to determine if packets have been 1576processed by translation rules. 1577Tags are 1578.Qq sticky , 1579meaning that the packet will be tagged even if the rule 1580is not the last matching rule. 1581Further matching rules can replace the tag with a 1582new one but will not remove a previously applied tag. 1583A packet is only ever assigned one tag at a time. 1584.Ar pass 1585rules that use the 1586.Ar tag 1587keyword must also use 1588.Ar keep state , 1589.Ar modulate state 1590or 1591.Ar synproxy state . 1592Packet tagging can be done during 1593.Ar nat , 1594.Ar rdr , 1595or 1596.Ar binat 1597rules in addition to filter rules. 1598Tags take the same macros as labels (see above). 1599.It Ar tagged <string> 1600Used with filter or translation rules to specify that packets must already 1601be tagged with the given tag in order to match the rule. 1602Inverse tag matching can also be done 1603by specifying the 1604.Cm !\& 1605operator before the 1606.Ar tagged 1607keyword. 1608.It Ar probability <number> 1609A probability attribute can be attached to a rule, with a value set between 16100 and 1, bounds not included. 1611In that case, the rule will be honoured using the given probability value 1612only. 1613For example, the following rule will drop 20% of incoming ICMP packets: 1614.Bd -literal -offset indent 1615block in proto icmp probability 20% 1616.Ed 1617.El 1618.Sh ROUTING 1619If a packet matches a rule with a route option set, the packet filter will 1620route the packet according to the type of route option. 1621When such a rule creates state, the route option is also applied to all 1622packets matching the same connection. 1623.Bl -tag -width xxxx 1624.It Ar fastroute 1625The 1626.Ar fastroute 1627option does a normal route lookup to find the next hop for the packet. 1628.It Ar route-to 1629The 1630.Ar route-to 1631option routes the packet to the specified interface with an optional address 1632for the next hop. 1633When a 1634.Ar route-to 1635rule creates state, only packets that pass in the same direction as the 1636filter rule specifies will be routed in this way. 1637Packets passing in the opposite direction (replies) are not affected 1638and are routed normally. 1639.It Ar reply-to 1640The 1641.Ar reply-to 1642option is similar to 1643.Ar route-to , 1644but routes packets that pass in the opposite direction (replies) to the 1645specified interface. 1646Opposite direction is only defined in the context of a state entry, and 1647.Ar reply-to 1648is useful only in rules that create state. 1649It can be used on systems with multiple external connections to 1650route all outgoing packets of a connection through the interface 1651the incoming connection arrived through (symmetric routing enforcement). 1652.It Ar dup-to 1653The 1654.Ar dup-to 1655option creates a duplicate of the packet and routes it like 1656.Ar route-to . 1657The original packet gets routed as it normally would. 1658.El 1659.Sh POOL OPTIONS 1660For 1661.Ar nat 1662and 1663.Ar rdr 1664rules, (as well as for the 1665.Ar route-to , 1666.Ar reply-to 1667and 1668.Ar dup-to 1669rule options) for which there is a single redirection address which has a 1670subnet mask smaller than 32 for IPv4 or 128 for IPv6 (more than one IP 1671address), a variety of different methods for assigning this address can be 1672used: 1673.Bl -tag -width xxxx 1674.It Ar bitmask 1675The 1676.Ar bitmask 1677option applies the network portion of the redirection address to the address 1678to be modified (source with 1679.Ar nat , 1680destination with 1681.Ar rdr ) . 1682.It Ar random 1683The 1684.Ar random 1685option selects an address at random within the defined block of addresses. 1686.It Ar source-hash 1687The 1688.Ar source-hash 1689option uses a hash of the source address to determine the redirection address, 1690ensuring that the redirection address is always the same for a given source. 1691An optional key can be specified after this keyword either in hex or as a 1692string; by default 1693.Xr pfctl 8 1694randomly generates a key for source-hash every time the 1695ruleset is reloaded. 1696.It Ar round-robin 1697The 1698.Ar round-robin 1699option loops through the redirection address(es). 1700.Pp 1701When more than one redirection address is specified, 1702.Ar round-robin 1703is the only permitted pool type. 1704.It Ar static-port 1705With 1706.Ar nat 1707rules, the 1708.Ar static-port 1709option prevents 1710.Xr pf 4 1711from modifying the source port on TCP and UDP packets. 1712.El 1713.Pp 1714Additionally, the 1715.Ar sticky-address 1716option can be specified to help ensure that multiple connections from the 1717same source are mapped to the same redirection address. 1718This option can be used with the 1719.Ar random 1720and 1721.Ar round-robin 1722pool options. 1723Note that by default these associations are destroyed as soon as there are 1724no longer states which refer to them; in order to make the mappings last 1725beyond the lifetime of the states, increase the global options with 1726.Ar set timeout source-track 1727See 1728.Sx STATEFUL TRACKING OPTIONS 1729for more ways to control the source tracking. 1730.Sh STATEFUL INSPECTION 1731.Xr pf 4 1732is a stateful packet filter, which means it can track the state of 1733a connection. 1734Instead of passing all traffic to port 25, for instance, it is possible 1735to pass only the initial packet, and then begin to keep state. 1736Subsequent traffic will flow because the filter is aware of the connection. 1737.Pp 1738If a packet matches a 1739.Ar pass ... keep state 1740rule, the filter creates a state for this connection and automatically 1741lets pass all subsequent packets of that connection. 1742.Pp 1743Before any rules are evaluated, the filter checks whether the packet 1744matches any state. 1745If it does, the packet is passed without evaluation of any rules. 1746.Pp 1747States are removed after the connection is closed or has timed out. 1748.Pp 1749This has several advantages. 1750Comparing a packet to a state involves checking its sequence numbers. 1751If the sequence numbers are outside the narrow windows of expected 1752values, the packet is dropped. 1753This prevents spoofing attacks, such as when an attacker sends packets with 1754a fake source address/port but does not know the connection's sequence 1755numbers. 1756.Pp 1757Also, looking up states is usually faster than evaluating rules. 1758If there are 50 rules, all of them are evaluated sequentially in O(n). 1759Even with 50000 states, only 16 comparisons are needed to match a 1760state, since states are stored in a binary search tree that allows 1761searches in O(log2 n). 1762.Pp 1763For instance: 1764.Bd -literal -offset indent 1765block all 1766pass out proto tcp from any to any flags S/SA keep state 1767pass in proto tcp from any to any port 25 flags S/SA keep state 1768.Ed 1769.Pp 1770This ruleset blocks everything by default. 1771Only outgoing connections and incoming connections to port 25 are allowed. 1772The initial packet of each connection has the SYN 1773flag set, will be passed and creates state. 1774All further packets of these connections are passed if they match a state. 1775.Pp 1776By default, packets coming in and out of any interface can match a state, 1777but it is also possible to change that behaviour by assigning states to a 1778single interface or a group of interfaces. 1779.Pp 1780The default policy is specified by the 1781.Ar state-policy 1782global option, but this can be adjusted on individual filter rules by adding one 1783of the 1784.Ar if-bound , 1785.Ar group-bound , 1786or 1787.Ar floating 1788keywords to the 1789.Ar keep state 1790option. 1791For example, if a rule is defined as: 1792.Bd -literal -offset indent 1793pass out on ppp from any to 10.12/16 keep state (group-bound) 1794.Ed 1795.Pp 1796A state created on ppp0 would match packets an all PPP interfaces, 1797but not packets flowing through fxp0 or any other interface. 1798.Pp 1799You can adjust the state policy on individual 1800.Ar nat 1801and 1802.Ar rdr 1803translation rules by adding a keyword 1804.Ar if-bound , 1805.Ar group-bound 1806or 1807.Ar floating 1808at the end of the rule. 1809For example, a rule such as this, 1810.Bd -literal -offset indent 1811nat on sip0 from 10/8 to ! 10/8 -> 192.168.1.4/32 if-bound 1812.Ed 1813.Pp 1814will create states that only match packets on sip0. 1815.Pp 1816Keeping rules 1817.Ar floating 1818is the more flexible option when the firewall is in a dynamic routing 1819environment. 1820However, this has some security implications since a state created by one 1821trusted network could allow potentially hostile packets coming in from other 1822interfaces. 1823.Pp 1824Specifying 1825.Ar flags S/SA 1826restricts state creation to the initial SYN 1827packet of the TCP handshake. 1828One can also be less restrictive, and allow state creation from 1829intermediate 1830.Pq non-SYN 1831packets. 1832This will cause 1833.Xr pf 4 1834to synchronize to existing connections, for instance 1835if one flushes the state table. 1836.Pp 1837For UDP, which is stateless by nature, 1838.Ar keep state 1839will create state as well. 1840UDP packets are matched to states using only host addresses and ports. 1841.Pp 1842ICMP messages fall into two categories: ICMP error messages, which always 1843refer to a TCP or UDP packet, are matched against the referred to connection. 1844If one keeps state on a TCP connection, and an ICMP source quench message 1845referring to this TCP connection arrives, it will be matched to the right 1846state and get passed. 1847.Pp 1848For ICMP queries, 1849.Ar keep state 1850creates an ICMP state, and 1851.Xr pf 4 1852knows how to match ICMP replies to states. 1853For example, 1854.Bd -literal -offset indent 1855pass out inet proto icmp all icmp-type echoreq keep state 1856.Ed 1857.Pp 1858allows echo requests (such as those created by 1859.Xr ping 8 ) 1860out, creates state, and matches incoming echo replies correctly to states. 1861.Pp 1862Note: 1863.Ar nat , binat No and Ar rdr 1864rules implicitly create state for connections. 1865.Sh STATE MODULATION 1866Much of the security derived from TCP is attributable to how well the 1867initial sequence numbers (ISNs) are chosen. 1868Some popular stack implementations choose 1869.Em very 1870poor ISNs and thus are normally susceptible to ISN prediction exploits. 1871By applying a 1872.Ar modulate state 1873rule to a TCP connection, 1874.Xr pf 4 1875will create a high quality random sequence number for each connection 1876endpoint. 1877.Pp 1878The 1879.Ar modulate state 1880directive implicitly keeps state on the rule and is 1881only applicable to TCP connections. 1882.Pp 1883For instance: 1884.Bd -literal -offset indent 1885block all 1886pass out proto tcp from any to any modulate state 1887pass in proto tcp from any to any port 25 flags S/SA modulate state 1888.Ed 1889.Pp 1890There are two caveats associated with state modulation: 1891A 1892.Ar modulate state 1893rule can not be applied to a pre-existing but unmodulated connection. 1894Such an application would desynchronize TCP's strict 1895sequencing between the two endpoints. 1896Instead, 1897.Xr pf 4 1898will treat the 1899.Ar modulate state 1900modifier as a 1901.Ar keep state 1902modifier and the pre-existing connection will be inferred without 1903the protection conferred by modulation. 1904.Pp 1905The other caveat affects currently modulated states when the state table 1906is lost (firewall reboot, flushing the state table, etc...). 1907.Xr pf 4 1908will not be able to infer a connection again after the state table flushes 1909the connection's modulator. 1910When the state is lost, the connection may be left dangling until the 1911respective endpoints time out the connection. 1912It is possible on a fast local network for the endpoints to start an ACK 1913storm while trying to resynchronize after the loss of the modulator. 1914Using a 1915.Ar flags S/SA 1916modifier on 1917.Ar modulate state 1918rules between fast networks is suggested to prevent ACK storms. 1919.Sh SYN PROXY 1920By default, 1921.Xr pf 4 1922passes packets that are part of a 1923.Xr tcp 4 1924handshake between the endpoints. 1925The 1926.Ar synproxy state 1927option can be used to cause 1928.Xr pf 4 1929itself to complete the handshake with the active endpoint, perform a handshake 1930with the passive endpoint, and then forward packets between the endpoints. 1931.Pp 1932No packets are sent to the passive endpoint before the active endpoint has 1933completed the handshake, hence so-called SYN floods with spoofed source 1934addresses will not reach the passive endpoint, as the sender can't complete the 1935handshake. 1936.Pp 1937The proxy is transparent to both endpoints, they each see a single 1938connection from/to the other endpoint. 1939.Xr pf 4 1940chooses random initial sequence numbers for both handshakes. 1941Once the handshakes are completed, the sequence number modulators 1942(see previous section) are used to translate further packets of the 1943connection. 1944Hence, 1945.Ar synproxy state 1946includes 1947.Ar modulate state 1948and 1949.Ar keep state . 1950.Pp 1951Rules with 1952.Ar synproxy 1953will not work if 1954.Xr pf 4 1955operates on a 1956.Xr bridge 4 . 1957.Pp 1958Example: 1959.Bd -literal -offset indent 1960pass in proto tcp from any to any port www flags S/SA synproxy state 1961.Ed 1962.Sh STATEFUL TRACKING OPTIONS 1963All three of 1964.Ar keep state , 1965.Ar modulate state 1966and 1967.Ar synproxy state 1968support the following options: 1969.Pp 1970.Bl -tag -width xxxx -compact 1971.It Ar max <number> 1972Limits the number of concurrent states the rule may create. 1973When this limit is reached, further packets matching the rule that would 1974create state are dropped, until existing states time out. 1975.\" .It Ar no-sync 1976.\" Prevent state changes for states created by this rule from appearing on the 1977.\" .Xr pfsync 4 1978.\" interface. 1979.It Ar <timeout> <seconds> 1980Changes the timeout values used for states created by this rule. 1981For a list of all valid timeout names, see 1982.Sx OPTIONS 1983above. 1984.El 1985.Pp 1986Multiple options can be specified, separated by commas: 1987.Bd -literal -offset indent 1988pass in proto tcp from any to any \e 1989 port www flags S/SA keep state \e 1990 (max 100, source-track rule, max-src-nodes 75, \e 1991 max-src-states 3, tcp.established 60, tcp.closing 5) 1992.Ed 1993.Pp 1994When the 1995.Ar source-track 1996keyword is specified, the number of states per source IP is tracked. 1997.Pp 1998.Bl -tag -width xxxx -compact 1999.It Ar source-track rule 2000The maximum number of states created by this rule is limited by the rule's 2001.Ar max-src-nodes 2002and 2003.Ar max-src-state 2004options. 2005Only state entries created by this particular rule count toward the rule's 2006limits. 2007.It Ar source-track global 2008The number of states created by all rules that use this option is limited. 2009Each rule can specify different 2010.Ar max-src-nodes 2011and 2012.Ar max-src-states 2013options, however state entries created by any participating rule count towards 2014each individual rule's limits. 2015.El 2016.Pp 2017The following limits can be set: 2018.Pp 2019.Bl -tag -width xxxx -compact 2020.It Ar max-src-nodes <number> 2021Limits the maximum number of source addresses which can simultaneously 2022have state table entries. 2023.It Ar max-src-states <number> 2024Limits the maximum number of simultaneous state entries that a single 2025source address can create with this rule. 2026.El 2027.Pp 2028For stateful TCP connections, limits on established connections (connections 2029which have completed the TCP 3-way handshake) can also be enforced 2030per source IP. 2031.Pp 2032.Bl -tag -width xxxx -compact 2033.It Ar max-src-conn <number> 2034Limits the maximum number of simultaneous TCP connections which have 2035completed the 3-way handshake that a single host can make. 2036.It Ar max-src-conn-rate <number> / <seconds> 2037Limit the rate of new connections over a time interval. 2038The connection rate is an approximation calculated as a moving average. 2039.El 2040.Pp 2041Because the 3-way handshake ensures that the source address is not being 2042spoofed, more aggressive action can be taken based on these limits. 2043With the 2044.Ar overload <table> 2045state option, source IP addresses which hit either of the limits on 2046established connections will be added to the named table. 2047This table can be used in the ruleset to block further activity from 2048the offending host, redirect it to a tarpit process, or restrict its 2049bandwidth. 2050.Pp 2051The optional 2052.Ar flush 2053keyword kills all states created by the matching rule which originate 2054from the host which exceeds these limits. 2055The 2056.Ar global 2057modifier to the flush command kills all states originating from the 2058offending host, regardless of which rule created the state. 2059.Pp 2060For example, the following rules will protect the webserver against 2061hosts making more than 100 connections in 10 seconds. 2062Any host which connects faster than this rate will have its address added 2063to the <bad_hosts> table and have all states originating from it flushed. 2064Any new packets arriving from this host will be dropped unconditionally 2065by the block rule. 2066.Bd -literal -offset indent 2067block quick from <bad_hosts> 2068pass in on $ext_if proto tcp to $webserver port www flags S/SA keep state \e 2069 (max-src-conn-rate 100/10, overload <bad_hosts> flush global) 2070.Ed 2071.Sh OPERATING SYSTEM FINGERPRINTING 2072Passive OS Fingerprinting is a mechanism to inspect nuances of a TCP 2073connection's initial SYN packet and guess at the host's operating system. 2074Unfortunately these nuances are easily spoofed by an attacker so the 2075fingerprint is not useful in making security decisions. 2076But the fingerprint is typically accurate enough to make policy decisions 2077upon. 2078.Pp 2079The fingerprints may be specified by operating system class, by 2080version, or by subtype/patchlevel. 2081The class of an operating system is typically the vendor or genre 2082and would be OpenBSD for the 2083.Xr pf 4 2084firewall itself. 2085The version of the oldest available OpenBSD release on the main ftp site 2086would be 2.6 and the fingerprint would be written 2087.Pp 2088.Dl \&"OpenBSD 2.6\&" 2089.Pp 2090The subtype of an operating system is typically used to describe the 2091patchlevel if that patch led to changes in the TCP stack behavior. 2092In the case of OpenBSD, the only subtype is for a fingerprint that was 2093normalized by the 2094.Ar no-df 2095scrub option and would be specified as 2096.Pp 2097.Dl \&"OpenBSD 3.3 no-df\&" 2098.Pp 2099Fingerprints for most popular operating systems are provided by 2100.Xr pf.os 5 . 2101Once 2102.Xr pf 4 2103is running, a complete list of known operating system fingerprints may 2104be listed by running: 2105.Pp 2106.Dl # pfctl -so 2107.Pp 2108Filter rules can enforce policy at any level of operating system specification 2109assuming a fingerprint is present. 2110Policy could limit traffic to approved operating systems or even ban traffic 2111from hosts that aren't at the latest service pack. 2112.Pp 2113The 2114.Ar unknown 2115class can also be used as the fingerprint which will match packets for 2116which no operating system fingerprint is known. 2117.Pp 2118Examples: 2119.Bd -literal -offset indent 2120pass out proto tcp from any os OpenBSD keep state 2121block out proto tcp from any os Doors 2122block out proto tcp from any os "Doors PT" 2123block out proto tcp from any os "Doors PT SP3" 2124block out from any os "unknown" 2125pass on lo0 proto tcp from any os "OpenBSD 3.3 lo0" keep state 2126.Ed 2127.Pp 2128Operating system fingerprinting is limited only to the TCP SYN packet. 2129This means that it will not work on other protocols and will not match 2130a currently established connection. 2131.Pp 2132Caveat: operating system fingerprints are occasionally wrong. 2133There are three problems: an attacker can trivially craft his packets to 2134appear as any operating system he chooses; 2135an operating system patch could change the stack behavior and no fingerprints 2136will match it until the database is updated; 2137and multiple operating systems may have the same fingerprint. 2138.Sh BLOCKING SPOOFED TRAFFIC 2139"Spoofing" is the faking of IP addresses, typically for malicious 2140purposes. 2141The 2142.Ar antispoof 2143directive expands to a set of filter rules which will block all 2144traffic with a source IP from the network(s) directly connected 2145to the specified interface(s) from entering the system through 2146any other interface. 2147.Pp 2148For example, the line 2149.Bd -literal -offset indent 2150antispoof for lo0 2151.Ed 2152.Pp 2153expands to 2154.Bd -literal -offset indent 2155block drop in on ! lo0 inet from 127.0.0.1/8 to any 2156block drop in on ! lo0 inet6 from ::1 to any 2157.Ed 2158.Pp 2159For non-loopback interfaces, there are additional rules to block incoming 2160packets with a source IP address identical to the interface's IP(s). 2161For example, assuming the interface wi0 had an IP address of 10.0.0.1 and a 2162netmask of 255.255.255.0, 2163the line 2164.Bd -literal -offset indent 2165antispoof for wi0 inet 2166.Ed 2167.Pp 2168expands to 2169.Bd -literal -offset indent 2170block drop in on ! wi0 inet from 10.0.0.0/24 to any 2171block drop in inet from 10.0.0.1 to any 2172.Ed 2173.Pp 2174Caveat: Rules created by the 2175.Ar antispoof 2176directive interfere with packets sent over loopback interfaces 2177to local addresses. 2178One should pass these explicitly. 2179.Sh FRAGMENT HANDLING 2180The size of IP datagrams (packets) can be significantly larger than the 2181maximum transmission unit (MTU) of the network. 2182In cases when it is necessary or more efficient to send such large packets, 2183the large packet will be fragmented into many smaller packets that will each 2184fit onto the wire. 2185Unfortunately for a firewalling device, only the first logical fragment will 2186contain the necessary header information for the subprotocol that allows 2187.Xr pf 4 2188to filter on things such as TCP ports or to perform NAT. 2189.Pp 2190Besides the use of 2191.Ar scrub 2192rules as described in 2193.Sx TRAFFIC NORMALIZATION 2194above, there are three options for handling fragments in the packet filter. 2195.Pp 2196One alternative is to filter individual fragments with filter rules. 2197If no 2198.Ar scrub 2199rule applies to a fragment, it is passed to the filter. 2200Filter rules with matching IP header parameters decide whether the 2201fragment is passed or blocked, in the same way as complete packets 2202are filtered. 2203Without reassembly, fragments can only be filtered based on IP header 2204fields (source/destination address, protocol), since subprotocol header 2205fields are not available (TCP/UDP port numbers, ICMP code/type). 2206The 2207.Ar fragment 2208option can be used to restrict filter rules to apply only to 2209fragments, but not complete packets. 2210Filter rules without the 2211.Ar fragment 2212option still apply to fragments, if they only specify IP header fields. 2213For instance, the rule 2214.Bd -literal -offset indent 2215pass in proto tcp from any to any port 80 2216.Ed 2217.Pp 2218never applies to a fragment, even if the fragment is part of a TCP 2219packet with destination port 80, because without reassembly this information 2220is not available for each fragment. 2221This also means that fragments cannot create new or match existing 2222state table entries, which makes stateful filtering and address 2223translation (NAT, redirection) for fragments impossible. 2224.Pp 2225It's also possible to reassemble only certain fragments by specifying 2226source or destination addresses or protocols as parameters in 2227.Ar scrub 2228rules. 2229.Pp 2230In most cases, the benefits of reassembly outweigh the additional 2231memory cost, and it's recommended to use 2232.Ar scrub 2233rules to reassemble 2234all fragments via the 2235.Ar fragment reassemble 2236modifier. 2237.Pp 2238The memory allocated for fragment caching can be limited using 2239.Xr pfctl 8 . 2240Once this limit is reached, fragments that would have to be cached 2241are dropped until other entries time out. 2242The timeout value can also be adjusted. 2243.Pp 2244Currently, only IPv4 fragments are supported and IPv6 fragments 2245are blocked unconditionally. 2246.Sh ANCHORS 2247Besides the main ruleset, 2248.Xr pfctl 8 2249can load rulesets into 2250.Ar anchor 2251attachment points. 2252An 2253.Ar anchor 2254is a container that can hold rules, address tables, and other anchors. 2255.Pp 2256An 2257.Ar anchor 2258has a name which specifies the path where 2259.Xr pfctl 8 2260can be used to access the anchor to perform operations on it, such as 2261attaching child anchors to it or loading rules into it. 2262Anchors may be nested, with components separated by 2263.Sq / 2264characters, similar to how file system hierarchies are laid out. 2265The main ruleset is actually the default anchor, so filter and 2266translation rules, for example, may also be contained in any anchor. 2267.Pp 2268An anchor can reference another 2269.Ar anchor 2270attachment point 2271using the following kinds 2272of rules: 2273.Bl -tag -width xxxx 2274.It Ar nat-anchor <name> 2275Evaluates the 2276.Ar nat 2277rules in the specified 2278.Ar anchor . 2279.It Ar rdr-anchor <name> 2280Evaluates the 2281.Ar rdr 2282rules in the specified 2283.Ar anchor . 2284.It Ar binat-anchor <name> 2285Evaluates the 2286.Ar binat 2287rules in the specified 2288.Ar anchor . 2289.It Ar anchor <name> 2290Evaluates the filter rules in the specified 2291.Ar anchor . 2292.It Ar load anchor <name> from <file> 2293Loads the rules from the specified file into the 2294anchor 2295.Ar name . 2296.El 2297.Pp 2298When evaluation of the main ruleset reaches an 2299.Ar anchor 2300rule, 2301.Xr pf 4 2302will proceed to evaluate all rules specified in that anchor. 2303.Pp 2304Matching filter and translation rules in anchors with the 2305.Ar quick 2306option are final and abort the evaluation of the rules in other 2307anchors 2308and the main ruleset. 2309.Pp 2310.Ar anchor 2311rules are evaluated relative to the anchor in which they are contained. 2312For example, all 2313.Ar anchor 2314rules specified in the main ruleset will reference anchor 2315attachment points underneath the main ruleset, and 2316.Ar anchor 2317rules specified in a file loaded from a 2318.Ar load anchor 2319rule will be attached under that anchor point. 2320.Pp 2321Rules may be contained in 2322.Ar anchor 2323attachment points which do not contain any rules when the main ruleset 2324is loaded, and later such anchors can be manipulated through 2325.Xr pfctl 8 2326without reloading the main ruleset or other anchors. 2327For example, 2328.Bd -literal -offset indent 2329ext_if = \&"kue0\&" 2330block on $ext_if all 2331anchor spam 2332pass out on $ext_if all keep state 2333pass in on $ext_if proto tcp from any \e 2334 to $ext_if port smtp keep state 2335.Ed 2336.Pp 2337blocks all packets on the external interface by default, then evaluates 2338all rules in the 2339.Ar anchor 2340named "spam", and finally passes all outgoing connections and 2341incoming connections to port 25. 2342.Bd -literal -offset indent 2343# echo \&"block in quick from 1.2.3.4 to any\&" \&| \e 2344 pfctl -a spam -f - 2345.Ed 2346.Pp 2347This loads a single rule into the 2348.Ar anchor , 2349which blocks all packets from a specific address. 2350.Pp 2351The anchor can also be populated by adding a 2352.Ar load anchor 2353rule after the 2354.Ar anchor 2355rule: 2356.Bd -literal -offset indent 2357anchor spam 2358load anchor spam from "/etc/pf-spam.conf" 2359.Ed 2360.Pp 2361When 2362.Xr pfctl 8 2363loads 2364.Nm pf.conf , 2365it will also load all the rules from the file 2366.Pa /etc/pf-spam.conf 2367into the anchor. 2368.Pp 2369Optionally, 2370.Ar anchor 2371rules can specify the parameter's 2372direction, interface, address family, protocol and source/destination 2373address/port 2374using the same syntax as filter rules. 2375When parameters are used, the 2376.Ar anchor 2377rule is only evaluated for matching packets. 2378This allows conditional evaluation of anchors, like: 2379.Bd -literal -offset indent 2380block on $ext_if all 2381anchor spam proto tcp from any to any port smtp 2382pass out on $ext_if all keep state 2383pass in on $ext_if proto tcp from any to $ext_if port smtp keep state 2384.Ed 2385.Pp 2386The rules inside 2387.Ar anchor 2388spam are only evaluated for 2389.Ar tcp 2390packets with destination port 25. 2391Hence, 2392.Bd -literal -offset indent 2393# echo \&"block in quick from 1.2.3.4 to any" \&| \e 2394 pfctl -a spam -f - 2395.Ed 2396.Pp 2397will only block connections from 1.2.3.4 to port 25. 2398.Pp 2399Anchors may end with the asterisk 2400.Pq Sq * 2401character, which signifies that all anchors attached at that point 2402should be evaluated in the alphabetical ordering of their anchor name. 2403For example, 2404.Bd -literal -offset indent 2405anchor "spam/*" 2406.Ed 2407.Pp 2408will evaluate each rule in each anchor attached to the 2409.Li spam 2410anchor. 2411Note that it will only evaluate anchors that are directly attached to the 2412.Li spam 2413anchor, and will not descend to evaluate anchors recursively. 2414.Pp 2415Since anchors are evaluated relative to the anchor in which they are 2416contained, there is a mechanism for accessing the parent and ancestor 2417anchors of a given anchor. 2418Similar to file system path name resolution, if the sequence 2419.Dq .. 2420appears as an anchor path component, the parent anchor of the current 2421anchor in the path evaluation at that point will become the new current 2422anchor. 2423As an example, consider the following: 2424.Bd -literal -offset indent 2425# echo ' anchor "spam/allowed" ' | pfctl -f - 2426# echo -e ' anchor "../banned" \en pass' | \e 2427 pfctl -a spam/allowed -f - 2428.Ed 2429.Pp 2430Evaluation of the main ruleset will lead into the 2431.Li spam/allowed 2432anchor, which will evaluate the rules in the 2433.Li spam/banned 2434anchor, if any, before finally evaluating the 2435.Ar pass 2436rule. 2437.Pp 2438Since the parser specification for anchor names is a string, any 2439reference to an anchor name containing solidus 2440.Pq Sq / 2441characters will require double quote 2442.Pq Sq \&" 2443characters around the anchor name. 2444.Sh TRANSLATION EXAMPLES 2445This example maps incoming requests on port 80 to port 8080, on 2446which a daemon is running (because, for example, it is not run as root, 2447and therefore lacks permission to bind to port 80). 2448.Bd -literal 2449# use a macro for the interface name, so it can be changed easily 2450ext_if = \&"ne3\&" 2451 2452# map daemon on 8080 to appear to be on 80 2453rdr on $ext_if proto tcp from any to any port 80 -> 127.0.0.1 port 8080 2454.Ed 2455.Pp 2456If the 2457.Ar pass 2458modifier is given, packets matching the translation rule are passed without 2459inspecting the filter rules: 2460.Bd -literal 2461rdr pass on $ext_if proto tcp from any to any port 80 -> 127.0.0.1 \e 2462 port 8080 2463.Ed 2464.Pp 2465In the example below, vlan12 is configured as 192.168.168.1; 2466the machine translates all packets coming from 192.168.168.0/24 to 204.92.77.111 2467when they are going out any interface except vlan12. 2468This has the net effect of making traffic from the 192.168.168.0/24 2469network appear as though it is the Internet routable address 2470204.92.77.111 to nodes behind any interface on the router except 2471for the nodes on vlan12. 2472(Thus, 192.168.168.1 can talk to the 192.168.168.0/24 nodes.) 2473.Bd -literal 2474nat on ! vlan12 from 192.168.168.0/24 to any -> 204.92.77.111 2475.Ed 2476.Pp 2477In the example below, the machine sits between a fake internal 144.19.74.* 2478network, and a routable external IP of 204.92.77.100. 2479The 2480.Ar no nat 2481rule excludes protocol AH from being translated. 2482.Bd -literal 2483# NO NAT 2484no nat on $ext_if proto ah from 144.19.74.0/24 to any 2485nat on $ext_if from 144.19.74.0/24 to any -> 204.92.77.100 2486.Ed 2487.Pp 2488In the example below, packets bound for one specific server, as well as those 2489generated by the sysadmins are not proxied; all other connections are. 2490.Bd -literal 2491# NO RDR 2492no rdr on $int_if proto { tcp, udp } from any to $server port 80 2493no rdr on $int_if proto { tcp, udp } from $sysadmins to any port 80 2494rdr on $int_if proto { tcp, udp } from any to any port 80 -> 127.0.0.1 \e 2495 port 80 2496.Ed 2497.Pp 2498This longer example uses both a NAT and a redirection. 2499The external interface has the address 157.161.48.183. 2500On the internal interface, we are running 2501.Xr ftp-proxy 8 , 2502listening for outbound ftp sessions captured to port 8021. 2503.Bd -literal 2504# NAT 2505# Translate outgoing packets' source addresses (any protocol). 2506# In this case, any address but the gateway's external address is mapped. 2507nat on $ext_if inet from ! ($ext_if) to any -> ($ext_if) 2508 2509# NAT PROXYING 2510# Map outgoing packets' source port to an assigned proxy port instead of 2511# an arbitrary port. 2512# In this case, proxy outgoing isakmp with port 500 on the gateway. 2513nat on $ext_if inet proto udp from any port = isakmp to any -> ($ext_if) \e 2514 port 500 2515 2516# BINAT 2517# Translate outgoing packets' source address (any protocol). 2518# Translate incoming packets' destination address to an internal machine 2519# (bidirectional). 2520binat on $ext_if from 10.1.2.150 to any -> $ext_if 2521 2522# RDR 2523# Translate incoming packets' destination addresses. 2524# As an example, redirect a TCP and UDP port to an internal machine. 2525rdr on $ext_if inet proto tcp from any to ($ext_if) port 8080 \e 2526 -> 10.1.2.151 port 22 2527rdr on $ext_if inet proto udp from any to ($ext_if) port 8080 \e 2528 -> 10.1.2.151 port 53 2529 2530# RDR 2531# Translate outgoing ftp control connections to send them to localhost 2532# for proxying with ftp-proxy(8) running on port 8021. 2533rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021 2534.Ed 2535.Pp 2536In this example, a NAT gateway is set up to translate internal addresses 2537using a pool of public addresses (192.0.2.16/28) and to redirect 2538incoming web server connections to a group of web servers on the internal 2539network. 2540.Bd -literal 2541# NAT LOAD BALANCE 2542# Translate outgoing packets' source addresses using an address pool. 2543# A given source address is always translated to the same pool address by 2544# using the source-hash keyword. 2545nat on $ext_if inet from any to any -> 192.0.2.16/28 source-hash 2546 2547# RDR ROUND ROBIN 2548# Translate incoming web server connections to a group of web servers on 2549# the internal network. 2550rdr on $ext_if proto tcp from any to any port 80 \e 2551 -> { 10.1.2.155, 10.1.2.160, 10.1.2.161 } round-robin 2552.Ed 2553.Sh FILTER EXAMPLES 2554.Bd -literal 2555# The external interface is kue0 2556# (157.161.48.183, the only routable address) 2557# and the private network is 10.0.0.0/8, for which we are doing NAT. 2558 2559# use a macro for the interface name, so it can be changed easily 2560ext_if = \&"kue0\&" 2561 2562# normalize all incoming traffic 2563scrub in on $ext_if all fragment reassemble 2564 2565# block and log everything by default 2566block return log on $ext_if all 2567 2568# block anything coming from source we have no back routes for 2569block in from no-route to any 2570 2571# block and log outgoing packets that do not have our address as source, 2572# they are either spoofed or something is misconfigured (NAT disabled, 2573# for instance), we want to be nice and do not send out garbage. 2574block out log quick on $ext_if from ! 157.161.48.183 to any 2575 2576# silently drop broadcasts (cable modem noise) 2577block in quick on $ext_if from any to 255.255.255.255 2578 2579# block and log incoming packets from reserved address space and invalid 2580# addresses, they are either spoofed or misconfigured, we cannot reply to 2581# them anyway (hence, no return-rst). 2582block in log quick on $ext_if from { 10.0.0.0/8, 172.16.0.0/12, \e 2583 192.168.0.0/16, 255.255.255.255/32 } to any 2584 2585# ICMP 2586 2587# pass out/in certain ICMP queries and keep state (ping) 2588# state matching is done on host addresses and ICMP id (not type/code), 2589# so replies (like 0/0 for 8/0) will match queries 2590# ICMP error messages (which always refer to a TCP/UDP packet) are 2591# handled by the TCP/UDP states 2592pass on $ext_if inet proto icmp all icmp-type 8 code 0 keep state 2593 2594# UDP 2595 2596# pass out all UDP connections and keep state 2597pass out on $ext_if proto udp all keep state 2598 2599# pass in certain UDP connections and keep state (DNS) 2600pass in on $ext_if proto udp from any to any port domain keep state 2601 2602# TCP 2603 2604# pass out all TCP connections and modulate state 2605pass out on $ext_if proto tcp all modulate state 2606 2607# pass in certain TCP connections and keep state (SSH, SMTP, DNS, IDENT) 2608pass in on $ext_if proto tcp from any to any port { ssh, smtp, domain, \e 2609 auth } flags S/SA keep state 2610 2611# pass in data mode connections for ftp-proxy running on this host. 2612# (see ftp-proxy(8) for details) 2613pass in on $ext_if proto tcp from any to 157.161.48.183 port >= 49152 \e 2614 flags S/SA keep state 2615 2616# Do not allow Windows 9x SMTP connections since they are typically 2617# a viral worm. Alternately we could limit these OSes to 1 connection each. 2618block in on $ext_if proto tcp from any os {"Windows 95", "Windows 98"} \e 2619 to any port smtp 2620 2621# Packet Tagging 2622 2623# three interfaces: $int_if, $ext_if, and $wifi_if (wireless). NAT is 2624# being done on $ext_if for all outgoing packets. tag packets in on 2625# $int_if and pass those tagged packets out on $ext_if. all other 2626# outgoing packets (i.e., packets from the wireless network) are only 2627# permitted to access port 80. 2628 2629pass in on $int_if from any to any tag INTNET keep state 2630pass in on $wifi_if from any to any keep state 2631 2632block out on $ext_if from any to any 2633pass out quick on $ext_if tagged INTNET keep state 2634pass out on $ext_if proto tcp from any to any port 80 keep state 2635 2636# tag incoming packets as they are redirected to spamd(8). use the tag 2637# to pass those packets through the packet filter. 2638 2639rdr on $ext_if inet proto tcp from <spammers> to port smtp \e 2640 tag SPAMD -> 127.0.0.1 port spamd 2641 2642block in on $ext_if 2643pass in on $ext_if inet proto tcp tagged SPAMD keep state 2644.Ed 2645.Sh GRAMMAR 2646Syntax for 2647.Nm 2648in BNF: 2649.Bd -literal 2650line = ( option | pf-rule | nat-rule | binat-rule | rdr-rule | 2651 antispoof-rule | altq-rule | queue-rule | anchor-rule | 2652 trans-anchors | load-anchors | table-rule ) 2653 2654option = "set" ( [ "timeout" ( timeout | "{" timeout-list "}" ) ] | 2655 [ "optimization" [ "default" | "normal" | 2656 "high-latency" | "satellite" | 2657 "aggressive" | "conservative" ] ] 2658 [ "limit" ( limit-item | "{" limit-list "}" ) ] | 2659 [ "loginterface" ( interface-name | "none" ) ] | 2660 [ "block-policy" ( "drop" | "return" ) ] | 2661 [ "state-policy" ( "if-bound" | "group-bound" | 2662 "floating" ) ] 2663 [ "require-order" ( "yes" | "no" ) ] 2664 [ "fingerprints" filename ] | 2665 [ "debug" ( "none" | "urgent" | "misc" | "loud" ) ] ) 2666 2667pf-rule = action [ ( "in" | "out" ) ] 2668 [ "log" | "log-all" ] [ "quick" ] 2669 [ "on" ifspec ] [ route ] [ af ] [ protospec ] 2670 hosts [ filteropt-list ] 2671 2672filteropt-list = filteropt-list filteropt | filteropt 2673filteropt = user | flags | icmp-type | icmp6-type | tos | 2674 ( "keep" | "modulate" | "synproxy" ) "state" 2675 [ "(" state-opts ")" ] | 2676 "fragment" | "no-df" | "min-ttl" number | 2677 "max-mss" number | "random-id" | "reassemble tcp" | 2678 fragmentation | "allow-opts" | 2679 "label" string | "tag" string | [ ! ] "tagged" string 2680 "queue" ( string | "(" string [ [ "," ] string ] ")" ) | 2681 "probability" number"%" 2682 2683nat-rule = [ "no" ] "nat" [ "pass" ] [ "on" ifspec ] [ af ] 2684 [ protospec ] hosts [ "tag" string ] [ "tagged" string ] 2685 [ "->" ( redirhost | "{" redirhost-list "}" ) 2686 [ portspec ] [ pooltype ] [ "static-port" ] ] 2687 [ ( "if-bound" | "group-bound" | "floating" ) ] 2688 2689binat-rule = [ "no" ] "binat" [ "pass" ] [ "on" interface-name ] 2690 [ af ] [ "proto" ( proto-name | proto-number ) ] 2691 "from" address [ "/" mask-bits ] "to" ipspec 2692 [ "tag" string ] [ "tagged" string ] 2693 [ "->" address [ "/" mask-bits ] ] 2694 2695rdr-rule = [ "no" ] "rdr" [ "pass" ] [ "on" ifspec ] [ af ] 2696 [ protospec ] hosts [ "tag" string ] [ "tagged" string ] 2697 [ "->" ( redirhost | "{" redirhost-list "}" ) 2698 [ portspec ] [ pooltype ] ] 2699 [ ( "if-bound" | "group-bound" | "floating" ) ] 2700 2701antispoof-rule = "antispoof" [ "log" ] [ "quick" ] 2702 "for" ( interface-name | "{" interface-list "}" ) 2703 [ af ] [ "label" string ] 2704 2705table-rule = "table" "<" string ">" [ tableopts-list ] 2706tableopts-list = tableopts-list tableopts | tableopts 2707tableopts = "persist" | "const" | "file" string | 2708 "{" [ tableaddr-list ] "}" 2709tableaddr-list = tableaddr-list [ "," ] tableaddr-spec | tableaddr-spec 2710tableaddr-spec = [ "!" ] tableaddr [ "/" mask-bits ] 2711tableaddr = hostname | ipv4-dotted-quad | ipv6-coloned-hex | 2712 interface-name | "self" 2713 2714altq-rule = "altq on" interface-name queueopts-list 2715 "queue" subqueue 2716queue-rule = "queue" string [ "on" interface-name ] queueopts-list 2717 subqueue 2718 2719anchor-rule = "anchor" string [ ( "in" | "out" ) ] [ "on" ifspec ] 2720 [ af ] [ "proto" ] [ protospec ] [ hosts ] 2721 2722trans-anchors = ( "nat-anchor" | "rdr-anchor" | "binat-anchor" ) string 2723 [ "on" ifspec ] [ af ] [ "proto" ] [ protospec ] [ hosts ] 2724 2725load-anchor = "load anchor" string "from" filename 2726 2727queueopts-list = queueopts-list queueopts | queueopts 2728queueopts = [ "bandwidth" bandwidth-spec ] | 2729 [ "qlimit" number ] | [ "tbrsize" number ] | 2730 [ "priority" number ] | [ schedulers ] 2731schedulers = ( cbq-def | priq-def | hfsc-def ) 2732bandwidth-spec = "number" ( "b" | "Kb" | "Mb" | "Gb" | "%" ) 2733 2734action = "pass" | "block" [ return ] | [ "no" ] "scrub" 2735return = "drop" | "return" | "return-rst" [ "( ttl" number ")" ] | 2736 "return-icmp" [ "(" icmpcode [ [ "," ] icmp6code ] ")" ] | 2737 "return-icmp6" [ "(" icmp6code ")" ] 2738icmpcode = ( icmp-code-name | icmp-code-number ) 2739icmp6code = ( icmp6-code-name | icmp6-code-number ) 2740 2741ifspec = ( [ "!" ] interface-name ) | "{" interface-list "}" 2742interface-list = [ "!" ] interface-name [ [ "," ] interface-list ] 2743route = "fastroute" | 2744 ( "route-to" | "reply-to" | "dup-to" ) 2745 ( routehost | "{" routehost-list "}" ) 2746 [ pooltype ] 2747af = "inet" | "inet6" 2748 2749protospec = "proto" ( proto-name | proto-number | 2750 "{" proto-list "}" ) 2751proto-list = ( proto-name | proto-number ) [ [ "," ] proto-list ] 2752 2753hosts = "all" | 2754 "from" ( "any" | "no-route" | "self" | host | 2755 "{" host-list "}" | "route" string ) [ port ] [ os ] 2756 "to" ( "any" | "no-route" | "self" | host | 2757 "{" host-list "}" | "route" string ) [ port ] 2758 2759ipspec = "any" | host | "{" host-list "}" 2760host = [ "!" ] ( address [ "/" mask-bits ] | "<" string ">" ) 2761redirhost = address [ "/" mask-bits ] 2762routehost = ( interface-name [ address [ "/" mask-bits ] ] ) 2763address = ( interface-name | "(" interface-name ")" | hostname | 2764 ipv4-dotted-quad | ipv6-coloned-hex ) 2765host-list = host [ [ "," ] host-list ] 2766redirhost-list = redirhost [ [ "," ] redirhost-list ] 2767routehost-list = routehost [ [ "," ] routehost-list ] 2768 2769port = "port" ( unary-op | binary-op | "{" op-list "}" ) 2770portspec = "port" ( number | name ) [ ":" ( "*" | number | name ) ] 2771os = "os" ( os-name | "{" os-list "}" ) 2772user = "user" ( unary-op | binary-op | "{" op-list "}" ) 2773.\" group = "group" ( unary-op | binary-op | "{" op-list "}" ) 2774 2775unary-op = [ "=" | "!=" | "<" | "<=" | ">" | ">=" ] 2776 ( name | number ) 2777binary-op = number ( "<>" | "><" | ":" ) number 2778op-list = ( unary-op | binary-op ) [ [ "," ] op-list ] 2779 2780os-name = operating-system-name 2781os-list = os-name [ [ "," ] os-list ] 2782 2783flags = "flags" [ flag-set ] "/" flag-set 2784flag-set = [ "F" ] [ "S" ] [ "R" ] [ "P" ] [ "A" ] [ "U" ] [ "E" ] 2785 [ "W" ] 2786 2787icmp-type = "icmp-type" ( icmp-type-code | "{" icmp-list "}" ) 2788icmp6-type = "icmp6-type" ( icmp-type-code | "{" icmp-list "}" ) 2789icmp-type-code = ( icmp-type-name | icmp-type-number ) 2790 [ "code" ( icmp-code-name | icmp-code-number ) ] 2791icmp-list = icmp-type-code [ [ "," ] icmp-list ] 2792 2793tos = "tos" ( "lowdelay" | "throughput" | "reliability" | 2794 [ "0x" ] number ) 2795 2796state-opts = state-opt [ [ "," ] state-opts ] 2797state-opt = ( "max" number | timeout | 2798 "source-track" [ ( "rule" | "global" ) ] | 2799 "max-src-nodes" number | "max-src-states" number | 2800 "max-src-conn" number | 2801 "max-src-conn-rate" number "/" number | 2802 "overload" "<" string ">" [ "flush" ] | 2803 "if-bound" | "group-bound" | "floating" ) 2804 2805fragmentation = [ "fragment reassemble" | "fragment crop" | 2806 "fragment drop-ovl" ] 2807 2808timeout-list = timeout [ [ "," ] timeout-list ] 2809timeout = ( "tcp.first" | "tcp.opening" | "tcp.established" | 2810 "tcp.closing" | "tcp.finwait" | "tcp.closed" | 2811 "udp.first" | "udp.single" | "udp.multiple" | 2812 "icmp.first" | "icmp.error" | 2813 "other.first" | "other.single" | "other.multiple" | 2814 "frag" | "interval" | "src.track" | 2815 "adaptive.start" | "adaptive.end" ) number 2816 2817limit-list = limit-item [ [ "," ] limit-list ] 2818limit-item = ( "states" | "frags" | "src-nodes" ) number 2819 2820pooltype = ( "bitmask" | "random" | 2821 "source-hash" [ ( hex-key | string-key ) ] | 2822 "round-robin" ) [ sticky-address ] 2823 2824subqueue = string | "{" queue-list "}" 2825queue-list = string [ [ "," ] string ] 2826cbq-def = "cbq" [ "(" cbq-opt [ [ "," ] cbq-opt ] ")" ] 2827priq-def = "priq" [ "(" priq-opt [ [ "," ] priq-opt ] ")" ] 2828hfsc-def = "hfsc" [ "(" hfsc-opt [ [ "," ] hfsc-opt ] ")" ] 2829cbq-opt = ( "default" | "borrow" | "red" | "ecn" | "rio" ) 2830priq-opt = ( "default" | "red" | "ecn" | "rio" ) 2831hfsc-opt = ( "default" | "red" | "ecn" | "rio" | 2832 linkshare-sc | realtime-sc | upperlimit-sc ) 2833linkshare-sc = "linkshare" sc-spec 2834realtime-sc = "realtime" sc-spec 2835upperlimit-sc = "upperlimit" sc-spec 2836sc-spec = ( bandwidth-spec | 2837 "(" bandwidth-spec number bandwidth-spec ")" ) 2838.Ed 2839.Sh FILES 2840.Bl -tag -width "/etc/protocols" -compact 2841.It Pa /etc/hosts 2842Host name database. 2843.It Pa /etc/pf.conf 2844Default location of the ruleset file. 2845.It Pa /etc/pf.os 2846Default location of OS fingerprints. 2847.It Pa /etc/protocols 2848Protocol name database. 2849.It Pa /etc/services 2850Service name database. 2851.It Pa /usr/share/examples/pf 2852Example rulesets. 2853.El 2854.Sh SEE ALSO 2855.Xr icmp 4 , 2856.Xr icmp6 4 , 2857.Xr ip 4 , 2858.Xr ip6 4 , 2859.Xr pf 4 , 2860.\" .Xr pfsync 4 , 2861.Xr route 4 , 2862.Xr tcp 4 , 2863.Xr udp 4 , 2864.Xr hosts 5 , 2865.Xr pf.os 5 , 2866.Xr protocols 5 , 2867.Xr services 5 , 2868.Xr ftp-proxy 8 , 2869.Xr pfctl 8 , 2870.Xr pflogd 8 , 2871.Xr route 8 2872.Sh HISTORY 2873The 2874.Nm 2875file format first appeared in 2876.Ox 3.0 . 2877