1.\" $OpenBSD: pf.conf.5,v 1.538 2014/05/28 21:13:21 jmc Exp $ 2.\" 3.\" Copyright (c) 2002, Daniel Hartmeier 4.\" Copyright (c) 2003 - 2013 Henning Brauer <henning@openbsd.org> 5.\" All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 11.\" - Redistributions of source code must retain the above copyright 12.\" notice, this list of conditions and the following disclaimer. 13.\" - Redistributions in binary form must reproduce the above 14.\" copyright notice, this list of conditions and the following 15.\" disclaimer in the documentation and/or other materials provided 16.\" with the distribution. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19.\" "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 20.\" LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 21.\" FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 22.\" COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 23.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 24.\" BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 25.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 26.\" CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 28.\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29.\" POSSIBILITY OF SUCH DAMAGE. 30.\" 31.Dd $Mdocdate: May 28 2014 $ 32.Dt PF.CONF 5 33.Os 34.Sh NAME 35.Nm pf.conf 36.Nd packet filter configuration file 37.Sh DESCRIPTION 38The 39.Xr pf 4 40packet filter modifies, drops, or passes packets according to rules or 41definitions specified in 42.Nm . 43.Pp 44This is an overview of the sections in this manual page: 45.Bl -ohang 46.It Sy Packet Filtering 47Packet filtering, including network address translation (NAT). 48.It Sy Options 49Global options tune the behaviour of the packet filtering engine. 50.It Sy Queueing 51Queueing provides rule-based bandwidth control. 52.It Sy Tables 53Tables provide a method for dealing with large numbers of addresses. 54.It Sy Anchors 55Anchors are containers for rules and tables. 56.It Sy Stateful Filtering 57Stateful filtering tracks packets by state. 58.It Sy Traffic Normalisation 59Including scrub, fragment handling, and blocking spoofed traffic. 60.It Sy Operating System Fingerprinting 61A method for detecting a host's operating system. 62.It Sy Examples 63Some example rulesets. 64.El 65.Pp 66The current line can be extended over multiple lines using a backslash 67.Pq Sq \e . 68Comments can be put anywhere in the file using a hash mark 69.Pq Sq # , 70and extend to the end of the current line. 71Care should be taken when commenting out multi-line text: 72the comment is effective until the end of the entire block. 73.Pp 74Argument names not beginning with a letter, digit, or underscore 75must be quoted. 76.Pp 77Additional configuration files can be included with the 78.Ic include 79keyword, for example: 80.Bd -literal -offset indent 81include "/etc/pf/sub.filter.conf" 82.Ed 83.Pp 84Macros can be defined that will later be expanded in context. 85Macro names must start with a letter, digit, or underscore, 86and may contain any of those characters. 87Macro names may not be reserved words (for example 88.Ar pass , 89.Ar in , 90.Ar out ) . 91Macros are not expanded inside quotes. 92.Pp 93For example: 94.Bd -literal -offset indent 95ext_if = "kue0" 96all_ifs = "{" $ext_if lo0 "}" 97pass out on $ext_if from any to any 98pass in on $ext_if proto tcp from any to any port 25 99.Ed 100.Sh PACKET FILTERING 101.Xr pf 4 102has the ability to 103.Ar block , 104.Ar pass , 105and 106.Ar match 107packets based on attributes of their layer 3 108and layer 4 headers. 109Filter rules determine which of these actions are taken; 110filter parameters specify the packets to which a rule applies. 111.Pp 112For each packet processed by the packet filter, the filter rules are 113evaluated in sequential order, from first to last. 114For 115.Ar block 116and 117.Ar pass , 118the last matching rule decides what action is taken; 119if no rule matches the packet, the default action is to pass 120the packet without creating a state. 121For 122.Ar match , 123rules are evaluated every time they match; 124the pass/block state of a packet remains unchanged. 125.Pp 126Most parameters are optional. 127If a parameter is specified, the rule only applies to packets with 128matching attributes. 129Certain parameters can be expressed as lists, in which case 130.Xr pfctl 8 131generates all needed rule combinations. 132.Pp 133By default 134.Xr pf 4 135filters packets statefully: 136the first time a packet matches a 137.Ar pass 138rule, a state entry is created. 139The packet filter examines each packet to see if it matches an existing state. 140If it does, the packet is passed without evaluation of any rules. 141After the connection is closed or times out, the state entry is automatically 142removed. 143.Pp 144The following actions can be used in the filter: 145.Bl -tag -width xxxx 146.It Ar block 147The packet is blocked. 148There are a number of ways in which a 149.Ar block 150rule can behave when blocking a packet. 151The default behaviour is to 152.Ar drop 153packets silently, however this can be overridden or made 154explicit either globally, by setting the 155.Ar block-policy 156option, or on a per-rule basis with one of the following options: 157.Pp 158.Bl -tag -width "return-icmp6XXX" -compact 159.It Ar drop 160The packet is silently dropped. 161.It Ar return 162This causes a TCP RST to be returned for TCP packets 163and an ICMP UNREACHABLE for other types of packets. 164.It Ar return-icmp 165.It Ar return-icmp6 166This causes ICMP messages to be returned for packets which match the rule. 167By default this is an ICMP UNREACHABLE message, however this 168can be overridden by specifying a message as a code or number. 169.It Ar return-rst 170This applies only to TCP packets, 171and issues a TCP RST which closes the connection. 172An optional parameter, 173.Ar ttl , 174may be given with a TTL value. 175.El 176.Pp 177Options returning ICMP packets currently have no effect if 178.Xr pf 4 179operates on a 180.Xr bridge 4 , 181as the code to support this feature has not yet been implemented. 182.Pp 183The simplest mechanism to block everything by default and only pass 184packets that match explicit rules is specify a first filter rule of: 185.Pp 186.Dl block all 187.It Ar match 188The packet is matched. 189This mechanism is used to provide fine grained filtering 190without altering the block/pass state of a packet. 191.Ar match 192rules differ from block and pass rules in that 193parameters are set every time a packet matches the rule, 194not only on the last matching rule. 195For the following parameters, 196this means that the parameter effectively becomes 197.Dq sticky 198until explicitly overridden: 199.Ar nat-to , 200.Ar binat-to , 201.Ar rdr-to , 202.Ar queue , 203.Ar rtable , 204and 205.Ar scrub . 206.Pp 207.Ar log 208is different still, 209in that the action happens every time a rule matches 210i.e. a single packet can get logged more than once. 211.It Ar pass 212The packet is passed; 213state is created unless the 214.Ar no state 215option is specified. 216.El 217.Pp 218The following parameters can be used in the filter: 219.Bl -tag -width Ds 220.It Ar in No or Ar out 221A packet always comes in on, or goes out through, one interface. 222.Ar in 223and 224.Ar out 225apply to incoming and outgoing packets; 226if neither are specified, 227the rule will match packets in both directions. 228.It Ar log 229In addition to the action specified, a log message is generated. 230Only the packet that establishes the state is logged, 231unless the 232.Ar no state 233option is specified. 234The logged packets are sent to a 235.Xr pflog 4 236interface, by default 237.Ar pflog0 . 238This interface is monitored by the 239.Xr pflogd 8 240logging daemon, which dumps the logged packets to the file 241.Pa /var/log/pflog 242in 243.Xr pcap 3 244binary format. 245.It Ar log Pq Ar all 246Used to force logging of all packets for a connection. 247This is not necessary when 248.Ar no state 249is explicitly specified. 250As with 251.Ar log , 252packets are logged to 253.Xr pflog 4 . 254.It Ar log Pq Ar matches 255Used to force logging of this packet on all subsequent matching rules. 256.It Ar log Pq Ar user 257Logs the UID and PID of the 258socket on the local host used to send or receive a packet, 259in addition to the normal information. 260.It Ar log Pq Ar to Aq Ar interface 261Send logs to the specified 262.Xr pflog 4 263interface instead of 264.Ar pflog0 . 265.It Ar quick 266If a packet matches a rule which has the 267.Ar quick 268option set, this rule 269is considered the last matching rule, and evaluation of subsequent rules 270is skipped. 271.It Ar on Aq Ar interface 272This rule applies only to packets coming in on, or going out through, this 273particular interface or interface group. 274For more information on interface groups, 275see the 276.Ic group 277keyword in 278.Xr ifconfig 8 . 279.Ar any 280will match any existing interface except loopback ones. 281.It Ar on Ar rdomain Aq Ar number 282This rule applies only to packets coming in on, or going out through, this 283particular routing domain. 284.It Aq Ar af 285This rule applies only to packets of this address family. 286Supported values are 287.Ar inet 288and 289.Ar inet6 . 290.It Ar proto Aq Ar protocol 291This rule applies only to packets of this protocol. 292Common protocols are ICMP, ICMP6, TCP, and UDP. 293For a list of all the protocol name to number mappings used by 294.Xr pfctl 8 , 295see the file 296.Em /etc/protocols . 297.It Xo 298.Ar from Aq Ar source 299.Ar port Aq Ar source 300.Ar os Aq Ar source 301.Ar to Aq Ar dest 302.Ar port Aq Ar dest 303.Xc 304This rule applies only to packets with the specified source and destination 305addresses and ports. 306.Pp 307Addresses can be specified in CIDR notation (matching netblocks), as 308symbolic host names, interface names or interface group names, or as any 309of the following keywords: 310.Pp 311.Bl -tag -width xxxxxxxxxxxxxx -compact 312.It Ar any 313Any address. 314.It Ar no-route 315Any address which is not currently routable. 316.It Ar route Aq Ar label 317Any address matching the given 318.Xr route 8 319label. 320.It Ar self 321Expands to all addresses assigned to all interfaces. 322.It Aq Ar table 323Any address matching the given table. 324.It Ar urpf-failed 325Any source address that fails a unicast reverse path forwarding (URPF) 326check, i.e. packets coming in on an interface other than that which holds 327the route back to the packet's source address. 328.El 329.Pp 330Ranges of addresses are specified using the 331.Sq - 332operator. 333For instance: 334.Dq 10.1.1.10 - 10.1.1.12 335means all addresses from 10.1.1.10 to 10.1.1.12, 336hence addresses 10.1.1.10, 10.1.1.11, and 10.1.1.12. 337.Pp 338Interface names, interface group names, and 339.Ar self 340can have modifiers appended: 341.Pp 342.Bl -tag -width xxxxxxxxxxxx -compact 343.It Ar :0 344Do not include interface aliases. 345.It Ar :broadcast 346Translates to the interface's broadcast address(es). 347.It Ar :network 348Translates to the network(s) attached to the interface. 349.It Ar :peer 350Translates to the point-to-point interface's peer address(es). 351.El 352.Pp 353Host names may also have the 354.Ar :0 355option appended to restrict the name resolution to the first of each 356v4 and v6 address found. 357.Pp 358Host name resolution and interface to address translation are done at 359ruleset load-time. 360When the address of an interface (or host name) changes (under DHCP or PPP, 361for instance), the ruleset must be reloaded for the change to be reflected 362in the kernel. 363Surrounding the interface name (and optional modifiers) in parentheses 364changes this behaviour. 365When the interface name is surrounded by parentheses, the rule is 366automatically updated whenever the interface changes its address. 367The ruleset does not need to be reloaded. 368This is especially useful with 369.Ar nat . 370.Pp 371Ports can be specified either by number or by name. 372For example, port 80 can be specified as 373.Em www . 374For a list of all port name to number mappings used by 375.Xr pfctl 8 , 376see the file 377.Pa /etc/services . 378.Pp 379Ports and ranges of ports are specified using these operators: 380.Bd -literal -offset indent 381= (equal) 382!= (unequal) 383\*(Lt (less than) 384\*(Le (less than or equal) 385\*(Gt (greater than) 386\*(Ge (greater than or equal) 387: (range including boundaries) 388\*(Gt\*(Lt (range excluding boundaries) 389\*(Lt\*(Gt (except range) 390.Ed 391.Pp 392.Sq \*(Gt\*(Lt , 393.Sq \*(Lt\*(Gt 394and 395.Sq \&: 396are binary operators (they take two arguments). 397For instance: 398.Bl -tag -width Ds 399.It port 2000:2004 400means 401.Sq all ports \*(Ge 2000 and \*(Le 2004 , 402hence ports 2000, 2001, 2002, 2003, and 2004. 403.It port 2000 \*(Gt\*(Lt 2004 404means 405.Sq all ports \*(Gt 2000 and \*(Lt 2004 , 406hence ports 2001, 2002, and 2003. 407.It port 2000 \*(Lt\*(Gt 2004 408means 409.Sq all ports \*(Lt 2000 or \*(Gt 2004 , 410hence ports 1\(en1999 and 2005\(en65535. 411.El 412.Pp 413The operating system of the source host can be specified in the case of TCP 414rules with the 415.Ar os 416modifier. 417See the 418.Sx OPERATING SYSTEM FINGERPRINTING 419section for more information. 420.Pp 421The host, port, and OS specifications are optional, 422as in the following examples: 423.Bd -literal -offset indent 424pass in all 425pass in from any to any 426pass in proto tcp from any port \*(Lt 1024 to any 427pass in proto tcp from any to any port 25 428pass in proto tcp from 10.0.0.0/8 port \*(Ge 1024 \e 429 to ! 10.1.2.3 port != ssh 430pass in proto tcp from any os "OpenBSD" 431pass in proto tcp from route "DTAG" 432.Ed 433.El 434.Pp 435The following additional parameters can be used in the filter: 436.Pp 437.Bl -tag -width Ds -compact 438.It Ar all 439This is equivalent to "from any to any". 440.Pp 441.It Ar allow-opts 442By default, IPv4 packets with IP options or IPv6 packets with routing 443extension headers are blocked. 444When 445.Ar allow-opts 446is specified for a 447.Ar pass 448rule, packets that pass the filter based on that rule (last matching) 449do so even if they contain IP options or routing extension headers. 450For packets that match state, the rule that initially created the 451state is used. 452The implicit 453.Ar pass 454rule that is used when a packet does not match any rules does not 455allow IP options. 456.Pp 457.It Ar divert-packet Ar port Aq Ar port 458Used to send matching packets to 459.Xr divert 4 460sockets bound to port 461.Ar port . 462If the default option of fragment reassembly is enabled, scrubbing with 463.Ar reassemble tcp 464is also enabled for 465.Ar divert-packet 466rules. 467.Pp 468.It Ar divert-reply 469Used to receive replies for sockets that are bound to addresses 470which are not local to the machine. 471See 472.Xr setsockopt 2 473for information on how to bind these sockets. 474.Pp 475.It Xo Ar divert-to Aq Ar host 476.Ar port Aq Ar port 477.Xc 478Used to redirect packets to a local socket bound to 479.Ar host 480and 481.Ar port . 482The packets will not be modified, so 483.Xr getsockname 2 484on the socket will return the original destination address of the packet. 485.Pp 486.It Xo Ar flags Aq Ar a 487.Pf / Ns Aq Ar b 488.No \*(Ba Ar any 489.Xc 490This rule only applies to TCP packets that have the flags 491.Aq Ar a 492set out of set 493.Aq Ar b . 494Flags not specified in 495.Aq Ar b 496are ignored. 497For stateful connections, the default is 498.Ar flags S/SA . 499To indicate that flags should not be checked at all, specify 500.Ar flags any . 501The flags are: (F)IN, (S)YN, (R)ST, (P)USH, (A)CK, (U)RG, (E)CE, and C(W)R. 502.Bl -tag -width Fl 503.It Ar flags S/S 504Flag SYN is set. 505The other flags are ignored. 506.It Ar flags S/SA 507This is the default setting for stateful connections. 508Out of SYN and ACK, exactly SYN may be set. 509SYN, SYN+PSH, and SYN+RST match, but SYN+ACK, ACK, and ACK+RST do not. 510This is more restrictive than the previous example. 511.It Ar flags /SFRA 512If the first set is not specified, it defaults to none. 513All of SYN, FIN, RST, and ACK must be unset. 514.El 515.Pp 516Because 517.Ar flags S/SA 518is applied by default (unless 519.Ar no state 520is specified), only the initial SYN packet of a TCP handshake will create 521a state for a TCP connection. 522It is possible to be less restrictive, and allow state creation from 523intermediate 524.Pq non-SYN 525packets, by specifying 526.Ar flags any . 527This will cause 528.Xr pf 4 529to synchronize to existing connections, for instance 530if one flushes the state table. 531However, states created from such intermediate packets may be missing 532connection details such as the TCP window scaling factor. 533States which modify the packet flow, such as those affected by 534.Ar af-to , 535.Ar modulate , 536.Ar nat-to , 537.Ar rdr-to , 538or 539.Ar synproxy state 540options, or scrubbed with 541.Ar reassemble tcp , 542will also not be recoverable from intermediate packets. 543Such connections will stall and time out. 544.Pp 545.It Ar group Aq Ar group 546Similar to 547.Ar user , 548this rule only applies to packets of sockets owned by the specified group. 549.Pp 550.It Xo Ar icmp-type Aq Ar type 551.Ar code Aq Ar code 552.Xc 553.It Xo Ar icmp6-type Aq Ar type 554.Ar code Aq Ar code 555.Xc 556This rule only applies to ICMP or ICMP6 packets with the specified type 557and code. 558Text names for ICMP types and codes are listed in 559.Xr icmp 4 560and 561.Xr icmp6 4 . 562The protocol and the ICMP type indicator 563.Po 564.Ar icmp-type 565or 566.Ar icmp6-type 567.Pc 568must match. 569.Pp 570.It Ar label Aq Ar string 571Adds a label to the rule, which can be used to identify the rule. 572For instance, 573.Dq pfctl -s labels 574shows per-rule statistics for rules that have labels. 575.Pp 576The following macros can be used in labels: 577.Pp 578.Bl -tag -width "$srcaddrXXX" -compact -offset indent 579.It Ar $dstaddr 580The destination IP address. 581.It Ar $dstport 582The destination port specification. 583.It Ar $if 584The interface. 585.It Ar $nr 586The rule number. 587.It Ar $proto 588The protocol name. 589.It Ar $srcaddr 590The source IP address. 591.It Ar $srcport 592The source port specification. 593.El 594.Pp 595For example: 596.Bd -literal -offset indent -compact 597ips = "{ 1.2.3.4, 1.2.3.5 }" 598pass in proto tcp from any to $ips \e 599 port \*(Gt 1023 label "$dstaddr:$dstport" 600.Ed 601.Pp 602Expands to: 603.Bd -literal -offset indent -compact 604pass in inet proto tcp from any to 1.2.3.4 \e 605 port \*(Gt 1023 label "1.2.3.4:\*(Gt1023" 606pass in inet proto tcp from any to 1.2.3.5 \e 607 port \*(Gt 1023 label "1.2.3.5:\*(Gt1023" 608.Ed 609.Pp 610The macro expansion for the 611.Ar label 612directive occurs only at configuration file parse time, not during runtime. 613.Pp 614.It Ar once 615Creates a one shot rule that will remove itself from an active ruleset after 616the first match. 617In case this is the only rule in the anchor, the anchor will be destroyed 618automatically after the rule is matched. 619.Pp 620.It Ar probability Aq Ar number 621A probability attribute can be attached to a rule, 622with a value set between 0 and 100%, 623in which case the rule is honoured using the given probability value. 624For example, the following rule will drop 20% of incoming ICMP packets: 625.Pp 626.Dl block in proto icmp probability 20% 627.Pp 628.It Ar received-on Aq Ar interface 629Only match packets which were received on the specified 630.Ar interface 631(or interface group). 632.Ar any 633will match any existing interface except loopback ones. 634.Pp 635.It Ar rtable Aq Ar number 636Used to select an alternate routing table for the routing lookup. 637Only effective before the route lookup happened, i.e. when filtering inbound. 638.Pp 639.It Xo Ar set prio Aq Ar priority 640.No \*(Ba ( Aq Ar priority , 641.Aq Ar priority ) 642.Xc 643Packets matching this rule will be assigned a specific queueing priority. 644Priorities are assigned as integers 0 through 7, 645with a default priority of 3. 646If the packet is transmitted on a 647.Xr vlan 4 648interface, the queueing priority will also be written as the priority 649code point in the 802.1Q VLAN header. 650If two priorities are given, packets which have a TOS of 651.Ar lowdelay 652and TCP ACKs with no data payload will be assigned to the second one. 653Packets with a higher priority number are processed first, 654and packets with the same priority are processed 655in the order in which they are received. 656.Pp 657For example: 658.Bd -literal -offset indent 659pass in proto tcp to port 25 set prio 2 660pass in proto tcp to port 22 set prio (2, 5) 661.Ed 662.Pp 663The interface priority queues accessed by the 664.Ar set prio 665keyword are always enabled and do not require any additional 666configuration, unlike the queues described below and in the 667.Sx QUEUEING 668section. 669.Pp 670.It Xo Ar set queue Aq Ar queue 671.No \*(Ba ( Aq Ar queue , 672.Aq Ar queue ) 673.Xc 674Packets matching this rule will be assigned to the specified queue. 675If two queues are given, packets which have a TOS of 676.Ar lowdelay 677and TCP ACKs with no data payload will be assigned to the second one. 678See 679.Sx QUEUEING 680for setup details. 681.Pp 682For example: 683.Bd -literal -offset indent 684pass in proto tcp to port 25 set queue mail 685pass in proto tcp to port 22 set queue(ssh_bulk, ssh_prio) 686.Ed 687.Pp 688.It Xo Ar set tos Aq Ar string 689.No \*(Ba Aq Ar number 690.Xc 691Enforces a TOS for matching packets. 692.Ar string 693may be one of 694.Ar critical , 695.Ar inetcontrol , 696.Ar lowdelay , 697.Ar netcontrol , 698.Ar throughput , 699.Ar reliability , 700or one of the DiffServ Code Points: 701.Ar ef , 702.Ar af11 ... af43 , 703.Ar cs0 ... cs7 ; 704.Ar number 705may be either a hex or decimal number. 706.Pp 707.It Ar tag Aq Ar string 708Packets matching this rule will be tagged with the 709specified string. 710The tag acts as an internal marker that can be used to 711identify these packets later on. 712This can be used, for example, to provide trust between 713interfaces and to determine if packets have been 714processed by translation rules. 715Tags are 716.Qq sticky , 717meaning that the packet will be tagged even if the rule 718is not the last matching rule. 719Further matching rules can replace the tag with a 720new one but will not remove a previously applied tag. 721A packet is only ever assigned one tag at a time. 722Tags take the same macros as labels (see above). 723.Pp 724.It Ar tagged Aq Ar string 725Used with filter or translation rules 726to specify that packets must already 727be tagged with the given tag in order to match the rule. 728Inverse tag matching can also be done 729by specifying the 730.Cm !\& 731operator before the 732.Ar tagged 733keyword. 734.Pp 735.It Xo Ar tos Aq Ar string 736.No \*(Ba Aq Ar number 737.Xc 738This rule applies to packets with the specified TOS bits set. 739.Ar string 740may be one of 741.Ar critical , 742.Ar inetcontrol , 743.Ar lowdelay , 744.Ar netcontrol , 745.Ar throughput , 746.Ar reliability , 747or one of the DiffServ Code Points: 748.Ar ef , 749.Ar af11 ... af43 , 750.Ar cs0 ... cs7 ; 751.Ar number 752may be either a hex or decimal number. 753.Pp 754For example, the following rules are identical: 755.Bd -literal -offset indent 756pass all tos lowdelay 757pass all tos 0x10 758pass all tos 16 759.Ed 760.Pp 761.It Ar user Aq Ar user 762This rule only applies to packets of sockets owned by the specified user. 763For outgoing connections initiated from the firewall, this is the user 764that opened the connection. 765For incoming connections to the firewall itself, this is the user that 766listens on the destination port. 767.Pp 768When listening sockets are bound to the wildcard address, 769.Xr pf 4 770cannot determine if a connection is destined for the firewall itself. 771To avoid false matches on just the destination port, combine a 772.Ar user 773rule with source or destination address 774.Ar self . 775.Pp 776All packets, both outgoing and incoming, of one connection are associated 777with the same user and group. 778Only TCP and UDP packets can be associated with users. 779.Pp 780User and group refer to the effective (as opposed to the real) IDs, in 781case the socket is created by a setuid/setgid process. 782User and group IDs are stored when a socket is created; 783when a process creates a listening socket as root (for instance, by 784binding to a privileged port) and subsequently changes to another 785user ID (to drop privileges), the credentials will remain root. 786.Pp 787User and group IDs can be specified as either numbers or names. 788The syntax is similar to the one for ports. 789The following example allows only selected users to open outgoing 790connections: 791.Bd -literal -offset indent 792block out proto tcp all 793pass out proto tcp from self user { \*(Lt 1000, dhartmei } 794.Ed 795.El 796.Ss Translation 797Translation options modify either the source or destination address and 798port of the packets associated with a stateful connection. 799.Xr pf 4 800modifies the specified address and/or port in the packet and recalculates 801IP, TCP, and UDP checksums as necessary. 802.Pp 803Subsequent rules will see packets as they look 804after any addresses and ports have been translated. 805These rules will therefore have to filter based on the translated 806address and port number. 807.Pp 808The state entry created permits 809.Xr pf 4 810to keep track of the original address for traffic associated with that state 811and correctly direct return traffic for that connection. 812.Pp 813Different types of translation are possible with pf: 814.Bl -tag -width xxxxxxxx 815.It Ar af-to 816Translation between different address families (NAT64) is handled 817using 818.Ar af-to 819rules. 820Because address family translation overrides the routing table, it's 821only possible to use 822.Ar af-to 823on inbound rules, and a source address for the resulting translation 824must always be specified. 825.Pp 826The optional second argument is the host or subnet the original 827addresses are translated into for the destination. 828The lowest bits of the original destination address form the host 829part of the new destination address according to the specified subnet. 830It is possible to embed a complete IPv4 address into an IPv6 address 831using a network prefix of /96 or smaller. 832.Pp 833When a destination address is not specified it is assumed that the host 834part is 32-bit long. 835For IPv6 to IPv4 translation this would mean using only the lower 32 836bits of the original IPv6 destination address. 837For IPv4 to IPv6 translation the destination subnet defaults to the 838subnet of the new IPv6 source address with a prefix length of /96. 839See RFC 6052 Section 2.2 for details on how the prefix determines the 840destination address encoding. 841.Pp 842For example, the following rules are identical: 843.Bd -literal -offset indent 844pass in inet af-to inet6 from 2001:db8::1 to 2001:db8::/96 845pass in inet af-to inet6 from 2001:db8::1 846.Ed 847.Pp 848In the above example the matching IPv4 packets will be modified to 849have a source address of 2001:db8::1 and a destination address will 850get prefixed with 2001:db8::/96, e.g. 198.51.100.100 will be 851translated to 2001:db8::c633:6464. 852.Pp 853In the reverse case the following rules are identical: 854.Bd -literal -offset indent 855pass in inet6 af-to inet from 198.51.100.1 to 0.0.0.0/0 856pass in inet6 af-to inet from 198.51.100.1 857.Ed 858.Pp 859The destination IPv4 address is assumed to be embedded inside the 860original IPv6 destination address, e.g. 64:ff9b::c633:6464 will be 861translated to 198.51.100.100. 862.Pp 863The current implementation will only extract IPv4 addresses from the 864IPv6 addresses with a prefix length of /96 and greater. 865.It Ar binat-to 866A 867.Ar binat-to 868rule specifies a bidirectional mapping between an external IP 869netblock and an internal IP netblock. 870It expands to an outbound 871.Ar nat-to 872rule and an inbound 873.Ar rdr-to 874rule. 875.It Ar nat-to 876A 877.Ar nat-to 878option specifies that IP addresses are to be changed as the packet 879traverses the given interface. 880This technique allows one or more IP addresses 881on the translating host to support network traffic for a larger range of 882machines on an "inside" network. 883Although in theory any IP address can be used on the inside, it is strongly 884recommended that one of the address ranges defined by RFC 1918 be used. 885Those netblocks are: 886.Bd -literal -offset indent 88710.0.0.0 \(en 10.255.255.255 (all of net 10, i.e. 10/8) 888172.16.0.0 \(en 172.31.255.255 (i.e. 172.16/12) 889192.168.0.0 \(en 192.168.255.255 (i.e. 192.168/16) 890.Ed 891.Pp 892.Ar nat-to 893is usually applied outbound. 894If applied inbound, nat-to to a local IP address is not supported. 895.It Ar rdr-to 896The packet is redirected to another destination and possibly a 897different port. 898.Ar rdr-to 899can optionally specify port ranges instead of single ports. 900For instance: 901.Bl -tag -width Ds 902.It match in ... port 2000:2999 rdr-to ... port 4000 903redirects ports 2000 to 2999 (inclusive) to port 4000. 904.It match in ... port 2000:2999 rdr-to ... port 4000:* 905redirects port 2000 to 4000, port 2001 to 4001, ..., port 2999 to 4999. 906.El 907.Pp 908.Ar rdr-to 909is usually applied inbound. 910If applied outbound, rdr-to to a local IP address is not supported. 911.El 912.Pp 913In addition to modifying the address, some translation rules may modify 914source or destination ports for TCP or UDP connections; 915implicitly in the case of 916.Ar nat-to 917options and explicitly in the case of 918.Ar rdr-to 919ones. 920Port numbers are never translated with a 921.Ar binat-to 922rule. 923.Pp 924Translation options apply only to packets that pass through the specified 925interface, and if no interface is specified, translation is applied 926to packets on all interfaces. 927For instance, redirecting port 80 on an external interface to an internal 928web server will only work for connections originating from the outside. 929Connections to the address of the external interface from local hosts will 930not be redirected, since such packets do not actually pass through the 931external interface. 932Redirections cannot reflect packets back through the interface they arrive 933on, they can only be redirected to hosts connected to different interfaces 934or to the firewall itself. 935.Pp 936However packets may be redirected to hosts connected to the interface the 937packet arrived on by using redirection with NAT. 938For example: 939.Bd -literal -offset indent 940pass in on $int_if proto tcp from $int_net to $ext_if port 80 \e 941 rdr-to $server 942pass out on $int_if proto tcp to $server port 80 \e 943 received-on $int_if nat-to $int_if 944.Ed 945.Pp 946Note that redirecting external incoming connections to the loopback address 947will effectively allow an external host to connect to daemons 948bound solely to the loopback address, circumventing the traditional 949blocking of such connections on a real interface. 950For example: 951.Bd -literal -offset indent 952pass in on egress proto tcp from any to any port smtp \e 953 rdr-to 127.0.0.1 port spamd 954.Ed 955.Pp 956Unless this effect is desired, any of the local non-loopback addresses 957should be used instead as the redirection target, which allows external 958connections only to daemons bound to this address or not bound to 959any address. 960.Pp 961For 962.Ar af-to , 963.Ar nat-to 964and 965.Ar rdr-to 966options for which there is a single redirection address which has a 967subnet mask smaller than 32 for IPv4 or 128 for IPv6 (more than one IP 968address), a variety of different methods for assigning this address can be 969used: 970.Bl -tag -width xxxx 971.It Ar bitmask 972The 973.Ar bitmask 974option applies the network portion of the redirection address to the address 975to be modified (source with 976.Ar nat-to , 977destination with 978.Ar rdr-to ) . 979.It Ar least-states Op Ar sticky-address 980The 981.Ar least-states 982option selects the address with the least active states from 983a given address pool and considers given weights 984associated with address(es). 985Weights can be specified between 1 and 65535. 986Addresses with higher weights are selected more often. 987.Pp 988.Ar sticky-address 989can be specified to ensure that multiple connections from the 990same source are mapped to the same redirection address. 991Associations are destroyed as soon as there are 992no longer states which refer to them; 993in order to make the mappings last 994beyond the lifetime of the states, 995increase the global options with 996.Ar set timeout src.track . 997.It Ar random Op Ar sticky-address 998The 999.Ar random 1000option selects an address at random within the defined block of addresses. 1001.Ar sticky-address 1002is as described above. 1003.It Ar round-robin Op Ar sticky-address 1004The 1005.Ar round-robin 1006option loops through the redirection address(es) and considers given weights 1007associated with address(es). 1008Weights can be specified between 1 and 65535. 1009Addresses with higher weights are selected more often. 1010.Ar sticky-address 1011is as described above. 1012.It Ar source-hash Op Ar key 1013The 1014.Ar source-hash 1015option uses a hash of the source address to determine the redirection address, 1016ensuring that the redirection address is always the same for a given source. 1017An optional 1018.Ar key 1019can be specified after this keyword either in hex or as a string; 1020by default 1021.Xr pfctl 8 1022randomly generates a key for source-hash every time the 1023ruleset is reloaded. 1024.It Ar static-port 1025With 1026.Ar nat 1027rules, the 1028.Ar static-port 1029option prevents 1030.Xr pf 4 1031from modifying the source port on TCP and UDP packets. 1032.El 1033.Pp 1034When more than one redirection address or a table is specified, 1035.Ar round-robin 1036and 1037.Ar least-states 1038are the only permitted pool types. 1039.Ss Routing 1040If a packet matches a rule with one of the following route options set, 1041the packet filter will route the packet according to the type of route option. 1042When such a rule creates state, the route option is also applied to all 1043packets matching the same connection. 1044.Bl -tag -width xxxx 1045.It Ar dup-to 1046The 1047.Ar dup-to 1048option creates a duplicate of the packet and routes it like 1049.Ar route-to . 1050The original packet gets routed as it normally would. 1051.It Ar reply-to 1052The 1053.Ar reply-to 1054option is similar to 1055.Ar route-to , 1056but routes packets that pass in the opposite direction (replies) to the 1057specified interface. 1058Opposite direction is only defined in the context of a state entry, and 1059.Ar reply-to 1060is useful only in rules that create state. 1061It can be used on systems with multiple external connections to 1062route all outgoing packets of a connection through the interface 1063the incoming connection arrived through (symmetric routing enforcement). 1064.It Ar route-to 1065The 1066.Ar route-to 1067option routes the packet to the specified interface with an optional address 1068for the next hop. 1069When a 1070.Ar route-to 1071rule creates state, only packets that pass in the same direction as the 1072filter rule specifies will be routed in this way. 1073Packets passing in the opposite direction (replies) are not affected 1074and are routed normally. 1075.El 1076.Pp 1077For the 1078.Ar dup-to , 1079.Ar reply-to , 1080and 1081.Ar route-to 1082route options 1083for which there is a single redirection address which has a 1084subnet mask smaller than 32 for IPv4 or 128 for IPv6 (more than one IP 1085address), 1086the methods 1087.Ar least-states , 1088.Ar random , 1089.Ar round-robin , 1090and 1091.Ar source-hash , 1092as described above, 1093can be used. 1094.Sh OPTIONS 1095.Xr pf 4 1096may be tuned for various situations using the 1097.Ar set 1098command. 1099.Bl -tag -width Ds 1100.It Ar set block-policy 1101The 1102.Ar block-policy 1103option sets the default behaviour for the packet 1104.Ar block 1105action: 1106.Pp 1107.Bl -tag -width xxxxxxxx -compact 1108.It Ar drop 1109Packet is silently dropped. 1110.It Ar return 1111A TCP RST is returned for blocked TCP packets, 1112an ICMP UNREACHABLE is returned for blocked UDP packets, 1113and all other packets are silently dropped. 1114.El 1115.It Ar set debug 1116Set the debug 1117.Ar level , 1118which limits the severity of log messages printed by 1119.Xr pf 4 . 1120This should be a keyword from the following ordered list 1121(highest to lowest): 1122.Cm emerg , 1123.Cm alert , 1124.Cm crit , 1125.Cm err , 1126.Cm warning , 1127.Cm notice , 1128.Cm info , 1129and 1130.Cm debug . 1131These keywords correspond to the similar (LOG_) values specified to the 1132.Xr syslog 3 1133library routine. 1134.It Ar set fingerprints 1135Load fingerprints of known operating systems from the given filename. 1136By default fingerprints of known operating systems are automatically 1137loaded from 1138.Xr pf.os 5 , 1139but can be overridden via this option. 1140Setting this option may leave a small period of time where the fingerprints 1141referenced by the currently active ruleset are inconsistent until the new 1142ruleset finishes loading. 1143.It Ar set hostid 1144The 32-bit 1145.Ar hostid 1146identifies this firewall's state table entries to other firewalls 1147in a 1148.Xr pfsync 4 1149failover cluster. 1150By default the hostid is set to a pseudo-random value, however it may be 1151desirable to manually configure it, for example to more easily identify the 1152source of state table entries. 1153The hostid may be specified in either decimal or hexadecimal. 1154.It Ar set limit 1155Sets hard limits on the memory pools used by the packet filter. 1156See 1157.Xr pool 9 1158for an explanation of memory pools. 1159.Pp 1160For example, 1161to set the maximum number of entries in the memory pool used by state table 1162entries (generated by 1163.Ar pass 1164rules which do not specify 1165.Ar no state ) 1166to 20000: 1167.Pp 1168.Dl set limit states 20000 1169.Pp 1170To set the maximum number of entries in the memory pool used for fragment 1171reassembly to 2000: 1172.Pp 1173.Dl set limit frags 2000 1174.Pp 1175This maximum may not exceed, and should be well below, the maximum number 1176of mbuf clusters 1177.Pq sysctl kern.maxclusters 1178in the system. 1179.Pp 1180To set the maximum number of entries in the memory pool used for tracking 1181source IP addresses (generated by the 1182.Ar sticky-address 1183and 1184.Ar src.track 1185options) to 2000: 1186.Pp 1187.Dl set limit src-nodes 2000 1188.Pp 1189To set limits on the memory pools used by tables: 1190.Bd -literal -offset indent 1191set limit tables 1000 1192set limit table-entries 100000 1193.Ed 1194.Pp 1195The first limits the number of tables that can exist to 1000. 1196The second limits the overall number of addresses that can be stored 1197in tables to 100000. 1198.Pp 1199Various limits can be combined on a single line: 1200.Bd -literal -offset indent 1201set limit { states 20000, frags 2000, src-nodes 2000 } 1202.Ed 1203.It Ar set loginterface 1204Enable collection of packet and byte count statistics for the given 1205interface or interface group. 1206These statistics can be viewed using: 1207.Pp 1208.Dl # pfctl -s info 1209.Pp 1210In this example 1211.Xr pf 4 1212collects statistics on the interface named dc0: 1213.Pp 1214.Dl set loginterface dc0 1215.Pp 1216One can disable the loginterface using: 1217.Pp 1218.Dl set loginterface none 1219.It Ar set optimization 1220Optimize state timeouts for one of the following network environments: 1221.Pp 1222.Bl -tag -width Ds -compact 1223.It Ar aggressive 1224Aggressively expire connections. 1225This can greatly reduce the memory usage of the firewall at the cost of 1226dropping idle connections early. 1227.It Ar conservative 1228Extremely conservative settings. 1229Avoid dropping legitimate connections at the 1230expense of greater memory utilization (possibly much greater on a busy 1231network) and slightly increased processor utilization. 1232.It Ar high-latency 1233A high-latency environment (such as a satellite connection). 1234.It Ar normal 1235A normal network environment. 1236Suitable for almost all networks. 1237.It Ar satellite 1238Alias for 1239.Ar high-latency . 1240.El 1241.It Ar set reassemble 1242The 1243.Ar reassemble 1244option is used to enable or disable the reassembly of fragmented packets, 1245and can be set to 1246.Ar yes 1247(the default) or 1248.Ar no . 1249If 1250.Ar no-df 1251is also specified, fragments with the 1252.Ar dont-fragment 1253bit set are reassembled too, 1254instead of being dropped; 1255the reassembled packet will have the 1256.Ar dont-fragment 1257bit cleared. 1258.It Ar set ruleset-optimization 1259.Bl -tag -width xxxxxxxx -compact 1260.It Ar basic 1261Enable basic ruleset optimization. 1262This is the default behaviour. 1263Basic ruleset optimization does four things to improve the 1264performance of ruleset evaluations: 1265.Pp 1266.Bl -enum -compact 1267.It 1268remove duplicate rules 1269.It 1270remove rules that are a subset of another rule 1271.It 1272combine multiple rules into a table when advantageous 1273.It 1274re-order the rules to improve evaluation performance 1275.El 1276.It Ar none 1277Disable the ruleset optimizer. 1278.It Ar profile 1279Uses the currently loaded ruleset as a feedback profile to tailor the 1280ordering of quick rules to actual network traffic. 1281.El 1282.Pp 1283It is important to note that the ruleset optimizer will modify the ruleset 1284to improve performance. 1285A side effect of the ruleset modification is that per-rule accounting 1286statistics will have different meanings than before. 1287If per-rule accounting is important for billing purposes or whatnot, 1288either the ruleset optimizer should not be used or a label field should 1289be added to all of the accounting rules to act as optimization barriers. 1290.Pp 1291Optimization can also be set as a command-line argument to 1292.Xr pfctl 8 , 1293overriding the settings in 1294.Nm . 1295.It Ar set skip on Aq Ar ifspec 1296List interfaces for which packets should not be filtered. 1297Packets passing in or out on such interfaces are passed as if pf was 1298disabled, i.e. pf does not process them in any way. 1299This can be useful on loopback and other virtual interfaces, when 1300packet filtering is not desired and can have unexpected effects. 1301.Ar ifspec 1302is only evaluated when the ruleset is loaded; interfaces created 1303later will not be skipped. 1304.It Ar set state-defaults 1305The 1306.Ar state-defaults 1307option sets the state options for states created from rules 1308without an explicit 1309.Ar keep state . 1310For example: 1311.Pp 1312.Dl set state-defaults pflow, no-sync 1313.It Ar set state-policy 1314The 1315.Ar state-policy 1316option sets the default behaviour for states: 1317.Pp 1318.Bl -tag -width if-bound -compact 1319.It Ar if-bound 1320States are bound to an interface. 1321.It Ar floating 1322States can match packets on any interfaces (the default). 1323.El 1324.It Ar set timeout 1325.Bl -tag -width "src.track" -compact 1326.It Ar frag 1327Seconds before an unassembled fragment is expired. 1328.It Ar interval 1329Interval between purging expired states and fragments. 1330.It Ar src.track 1331Length of time to retain a source tracking entry after the last state 1332expires. 1333.El 1334.Pp 1335When a packet matches a stateful connection, the seconds to live for the 1336connection will be updated to that of the 1337protocol and modifier 1338which corresponds to the connection state. 1339Each packet which matches this state will reset the TTL. 1340Tuning these values may improve the performance of the 1341firewall at the risk of dropping valid idle connections. 1342.Pp 1343.Bl -tag -width Ds -compact 1344.It Ar tcp.closed 1345The state after one endpoint sends an RST. 1346.It Ar tcp.closing 1347The state after the first FIN has been sent. 1348.It Ar tcp.established 1349The fully established state. 1350.It Ar tcp.finwait 1351The state after both FINs have been exchanged and the connection is closed. 1352Some hosts (notably web servers on Solaris) send TCP packets even after closing 1353the connection. 1354Increasing 1355.Ar tcp.finwait 1356(and possibly 1357.Ar tcp.closing ) 1358can prevent blocking of such packets. 1359.It Ar tcp.first 1360The state after the first packet. 1361.It Ar tcp.opening 1362The state after the second packet but before both endpoints have 1363acknowledged the connection. 1364.El 1365.Pp 1366ICMP and UDP are handled in a fashion similar to TCP, but with a much more 1367limited set of states: 1368.Pp 1369.Bl -tag -width Ds -compact 1370.It Ar icmp.error 1371The state after an ICMP error came back in response to an ICMP packet. 1372.It Ar icmp.first 1373The state after the first packet. 1374.It Ar udp.first 1375The state after the first packet. 1376.It Ar udp.multiple 1377The state if both hosts have sent packets. 1378.It Ar udp.single 1379The state if the source host sends more than one packet but the destination 1380host has never sent one back. 1381.El 1382.Pp 1383Other protocols are handled similarly to UDP: 1384.Pp 1385.Bl -tag -width xxxx -compact 1386.It Ar other.first 1387.It Ar other.multiple 1388.It Ar other.single 1389.El 1390.Pp 1391Timeout values can be reduced adaptively as the number of state table 1392entries grows. 1393.Pp 1394.Bl -tag -width Ds -compact 1395.It Ar adaptive.end 1396When reaching this number of state entries, all timeout values become 1397zero, effectively purging all state entries immediately. 1398This value is used to define the scale factor; it should not actually 1399be reached (set a lower state limit, see below). 1400.It Ar adaptive.start 1401When the number of state entries exceeds this value, adaptive scaling 1402begins. 1403All timeout values are scaled linearly with factor 1404(adaptive.end \- number of states) / (adaptive.end \- adaptive.start). 1405.El 1406.Pp 1407Adaptive timeouts are enabled by default, with an adaptive.start value 1408equal to 60% of the state limit, and an adaptive.end value equal to 1409120% of the state limit. 1410They can be disabled by setting both adaptive.start and adaptive.end to 0. 1411.Pp 1412The adaptive timeout values can be defined both globally and for each rule. 1413When used on a per-rule basis, the values relate to the number of 1414states created by the rule, otherwise to the total number of 1415states. 1416.Pp 1417For example: 1418.Bd -literal -offset indent 1419set timeout tcp.first 120 1420set timeout tcp.established 86400 1421set timeout { adaptive.start 6000, adaptive.end 12000 } 1422set limit states 10000 1423.Ed 1424.Pp 1425With 9000 state table entries, the timeout values are scaled to 50% 1426(tcp.first 60, tcp.established 43200). 1427.El 1428.Sh QUEUEING 1429Packets can be assigned to queues for the purpose of bandwidth 1430control. 1431At least one declaration is required to configure queues, and later 1432any packet filtering rule can reference the defined queues by name. 1433During the filtering component of 1434.Nm , 1435the last referenced 1436.Ar queue 1437name is where any passed packets will be queued, while for 1438blocked packets it specifies where any resulting ICMP or TCP RST 1439packets should be queued. 1440If the referenced queue does not exist on the outgoing interface the 1441default queue for that interface is used. 1442Queues attached to an interface build a tree, 1443thus each queue can have further child queues. 1444Only leaf queues, i.e. queues without children, can be used to assign 1445packets to. 1446The root queue must specifically reference an interface, all other queues 1447pick up the interface(s) they should be created on from their parent queues 1448unless explicitly specified. 1449.Pp 1450In the following example, a queue named std is created on the interface em0, 1451with 3 child queues ssh, mail and http. 1452.Bd -literal -offset indent 1453queue std on em0 bandwidth 100M 1454queue ssh parent std bandwidth 10M 1455queue mail parent std bandwidth 10M 1456queue http parent std bandwidth 80M default 1457.Ed 1458.Pp 1459The specified bandwidth is the target bandwidth, every queue can receive 1460more bandwidth as long as the parent still has some available. 1461The maximum bandwidth that should be assigned to a given queue can be limited 1462using the 1463.Ar max 1464keyword. 1465Similarily, a minimum (reserved) bandwidth can be specified. 1466.Bd -literal -offset indent 1467queue ssh parent std bandwidth 10M, min 5M, max 25M 1468.Ed 1469.Pp 1470For each of these 3 bandwidth specifications an additional burst bandwidth and 1471time can be specified. 1472.Bd -literal -offset indent 1473queue ssh parent std bandwidth 10M burst 90M for 100ms 1474.Ed 1475.Pp 1476All 1477.Ar bandwidth 1478values must be specified as an absolute value. 1479The suffixes 1480.Ar K , 1481.Ar M , 1482and 1483.Ar G 1484are used to represent bits, kilobits, megabits, and 1485gigabits per second, respectively. 1486The value must not exceed the interface bandwidth. 1487.Pp 1488In addition to the bandwidth specifications queues support the following 1489options: 1490.Bl -tag -width xxxx 1491.It Ar default 1492Packets not matched by another queue are assigned to this queue. 1493Exactly one default queue per interface is required. 1494.It Ar on Aq Ar interface 1495Specifies the interface the queue operates on. 1496If not given, it operates on all matching interfaces. 1497.It Ar parent Aq Ar name 1498Defines which parent queue the queue should be attached to. 1499Mandantory for all queues except root queues. 1500The parent queue must exist. 1501.It Ar qlimit Aq Ar limit 1502The maximum number of packets held in the queue. 1503The default is 50. 1504.El 1505.Pp 1506Packets can be assigned to queues based on filter rules by using the 1507.Ar queue 1508keyword. 1509Normally only one 1510.Ar queue 1511is specified; when a second one is specified it will instead be used for 1512packets which have a TOS of 1513.Ar lowdelay 1514and for TCP ACKs with no data payload. 1515.Pp 1516To continue the previous example, the examples below would specify the 1517four referenced 1518queues, plus a few child queues. 1519Interactive 1520.Xr ssh 1 1521sessions get a queue with a minimum bandwidth; 1522.Xr scp 1 1523and 1524.Xr sftp 1 1525bulk transfers go to a separate queue. 1526The queues are then referenced by filtering rules (see 1527.Sx PACKET FILTERING , 1528above). 1529.Bd -literal -offset 4n 1530queue rootq on em0 bandwidth 100M max 100M 1531queue http parent rootq bandwidth 60M burst 90M for 100ms 1532queue developers parent http bandwidth 45M 1533queue employees parent http bandwidth 15M 1534queue mail parent rootq bandwidth 10M 1535queue ssh parent rootq bandwidth 20M 1536queue ssh_interactive parent ssh bandwidth 10M min 5M 1537queue ssh_bulk parent ssh bandwidth 10M 1538queue std parent rootq bandwidth 20M default 1539 1540block return out on em0 inet all set queue std 1541pass out on em0 inet proto tcp from $developerhosts to any port 80 \e 1542 set queue developers 1543pass out on em0 inet proto tcp from $employeehosts to any port 80 \e 1544 set queue employees 1545pass out on em0 inet proto tcp from any to any port 22 \e 1546 set queue(ssh_bulk, ssh_interactive) 1547pass out on em0 inet proto tcp from any to any port 25 \e 1548 set queue mail 1549.Ed 1550.Sh TABLES 1551Tables are named structures which can hold a collection of addresses and 1552networks. 1553Lookups against tables in 1554.Xr pf 4 1555are relatively fast, making a single rule with tables much more efficient, 1556in terms of 1557processor usage and memory consumption, than a large number of rules which 1558differ only in IP address (either created explicitly or automatically by rule 1559expansion). 1560.Pp 1561Tables can be used as the source or destination of filter 1562or translation rules. 1563They can also be used for the redirect address of 1564.Ar nat-to 1565and 1566.Ar rdr-to 1567and in the routing options of filter rules, but only for 1568.Ar least-states 1569and 1570.Ar round-robin 1571pools. 1572.Pp 1573Tables can be defined with any of the following 1574.Xr pfctl 8 1575mechanisms. 1576As with macros, reserved words may not be used as table names. 1577.Bl -tag -width "manually" 1578.It Ar manually 1579Persistent tables can be manually created with the 1580.Ar add 1581or 1582.Ar replace 1583option of 1584.Xr pfctl 8 , 1585before or after the ruleset has been loaded. 1586.It Pa pf.conf 1587Table definitions can be placed directly in this file and loaded at the 1588same time as other rules are loaded, atomically. 1589Table definitions inside 1590.Nm 1591use the 1592.Ar table 1593statement, and are especially useful to define non-persistent tables. 1594The contents of a pre-existing table defined without a list of addresses 1595to initialize it is not altered when 1596.Nm 1597is loaded. 1598A table initialized with the empty list, 1599.Li { } , 1600will be cleared on load. 1601.El 1602.Pp 1603Tables may be defined with the following attributes: 1604.Bl -tag -width persist 1605.It Ar const 1606The 1607.Ar const 1608flag prevents the user from altering the contents of the table once it 1609has been created. 1610Without that flag, 1611.Xr pfctl 8 1612can be used to add or remove addresses from the table at any time, even 1613when running with 1614.Xr securelevel 7 1615= 2. 1616.It Ar counters 1617The 1618.Ar counters 1619flag enables per-address packet and byte counters, which can be displayed with 1620.Xr pfctl 8 . 1621.It Ar persist 1622The 1623.Ar persist 1624flag forces the kernel to keep the table even when no rules refer to it. 1625If the flag is not set, the kernel will automatically remove the table 1626when the last rule referring to it is flushed. 1627.El 1628.Pp 1629This example 1630creates a table called private, 1631to hold RFC 1918 private network blocks, 1632and a table called badhosts, 1633which is initially empty. 1634A filter rule is set up to block all traffic coming from addresses listed in 1635either table: 1636.Bd -literal -offset indent 1637table \*(Ltprivate\*(Gt const { 10/8, 172.16/12, 192.168/16 } 1638table \*(Ltbadhosts\*(Gt persist 1639block on fxp0 from { \*(Ltprivate\*(Gt, \*(Ltbadhosts\*(Gt } to any 1640.Ed 1641.Pp 1642The private table cannot have its contents changed and the badhosts table 1643will exist even when no active filter rules reference it. 1644Addresses may later be added to the badhosts table, so that traffic from 1645these hosts can be blocked by using the following: 1646.Pp 1647.Dl # pfctl -t badhosts -Tadd 204.92.77.111 1648.Pp 1649A table can also be initialized with an address list specified in one or more 1650external files, using the following syntax: 1651.Bd -literal -offset indent 1652table \*(Ltspam\*(Gt persist file "/etc/spammers" file "/etc/openrelays" 1653block on fxp0 from \*(Ltspam\*(Gt to any 1654.Ed 1655.Pp 1656The files 1657.Pa /etc/spammers 1658and 1659.Pa /etc/openrelays 1660list IP addresses, one per line. 1661Any lines beginning with a 1662.Sq # 1663are treated as comments and ignored. 1664In addition to being specified by IP address, hosts may also be 1665specified by their hostname. 1666When the resolver is called to add a hostname to a table, 1667.Ar all 1668resulting IPv4 and IPv6 addresses are placed into the table. 1669IP addresses can also be entered in a table by specifying a valid interface 1670name, a valid interface group, or the 1671.Ar self 1672keyword, in which case all addresses assigned to the interface(s) will be 1673added to the table. 1674.Sh ANCHORS 1675Besides the main ruleset, 1676.Nm 1677can specify 1678.Ar anchor 1679attachment points. 1680An anchor is a container that can hold rules, 1681address tables, and other anchors. 1682When evaluation of the main ruleset reaches an 1683.Ar anchor 1684rule, 1685.Xr pf 4 1686will proceed to evaluate all rules specified in that anchor. 1687.Pp 1688The following example blocks all packets on the external interface by default, 1689then evaluates all rules in the anchor named "spam", 1690and finally passes all outgoing connections and 1691incoming connections to port 25: 1692.Bd -literal -offset indent 1693ext_if = "kue0" 1694block on $ext_if all 1695anchor spam 1696pass out on $ext_if all 1697pass in on $ext_if proto tcp from any to $ext_if port smtp 1698.Ed 1699.Pp 1700Anchors can be manipulated through 1701.Xr pfctl 8 1702without reloading the main ruleset or other anchors. 1703This loads a single rule into the anchor, 1704which blocks all packets from a specific address: 1705.Bd -literal -offset indent 1706# echo "block in quick from 1.2.3.4 to any" | pfctl -a spam -f - 1707.Ed 1708.Pp 1709The anchor can also be populated by adding a 1710.Ar load anchor 1711rule after the anchor rule. 1712When 1713.Xr pfctl 8 1714loads 1715.Nm , 1716it will also load all the rules from the file 1717.Pa /etc/pf-spam.conf 1718into the anchor. 1719.Bd -literal -offset indent 1720anchor spam 1721load anchor spam from "/etc/pf-spam.conf" 1722.Ed 1723.Pp 1724Filter rule anchors can also be loaded inline in the ruleset 1725within a brace-delimited block. 1726Brace delimited blocks may contain rules or other brace-delimited blocks. 1727When anchors are loaded this way the anchor name becomes optional. 1728Since the parser specification for anchor names is a string, 1729double quote characters 1730.Pq Sq \&" 1731should be placed around the anchor name. 1732.Bd -literal -offset indent 1733anchor "external" on egress { 1734 block 1735 anchor out { 1736 pass proto tcp from any to port { 25, 80, 443 } 1737 } 1738 pass in proto tcp to any port 22 1739} 1740.Ed 1741.Pp 1742Anchor rules can also specify packet filtering parameters 1743using the same syntax as filter rules. 1744When parameters are used, 1745the anchor rule is only evaluated for matching packets. 1746This allows conditional evaluation of anchors, like: 1747.Bd -literal -offset indent 1748block on $ext_if all 1749anchor spam proto tcp from any to any port smtp 1750pass out on $ext_if all 1751pass in on $ext_if proto tcp from any to $ext_if port smtp 1752.Ed 1753.Pp 1754The rules inside anchor "spam" are only evaluated 1755for TCP packets with destination port 25. 1756Hence, the following 1757will only block connections from 1.2.3.4 to port 25: 1758.Bd -literal -offset indent 1759# echo "block in quick from 1.2.3.4 to any" | pfctl -a spam -f - 1760.Ed 1761.Pp 1762Matching filter and translation rules marked with the 1763.Ar quick 1764option are final and abort the evaluation of the rules in other 1765anchors and the main ruleset. 1766If the anchor itself is marked with the 1767.Ar quick 1768option, 1769ruleset evaluation will terminate when the anchor is exited if the packet is 1770matched by any rule within the anchor. 1771.Pp 1772An anchor references other anchor attachment points 1773using the following syntax: 1774.Bl -tag -width xxxx 1775.It Ar anchor Aq Ar name 1776Evaluates the filter rules in the specified anchor. 1777.El 1778.Pp 1779An anchor has a name which specifies the path where 1780.Xr pfctl 8 1781can be used to access the anchor to perform operations on it, such as 1782attaching child anchors to it or loading rules into it. 1783Anchors may be nested, with components separated by 1784.Sq / 1785characters, similar to how file system hierarchies are laid out. 1786The main ruleset is actually the default anchor, so filter and 1787translation rules, for example, may also be contained in any anchor. 1788.Pp 1789Anchor rules are evaluated relative to the anchor in which they are contained. 1790For example, 1791all anchor rules specified in the main ruleset will reference 1792anchor attachment points underneath the main ruleset, 1793and anchor rules specified in a file loaded from a 1794.Ar load anchor 1795rule will be attached under that anchor point. 1796.Pp 1797Anchors may end with the asterisk 1798.Pq Sq * 1799character, which signifies that all anchors attached at that point 1800should be evaluated in the alphabetical ordering of their anchor name. 1801For example, 1802the following 1803will evaluate each rule in each anchor attached to the "spam" anchor: 1804.Bd -literal -offset indent 1805anchor "spam/*" 1806.Ed 1807.Pp 1808Note that it will only evaluate anchors that are directly attached to the 1809"spam" anchor, and will not descend to evaluate anchors recursively. 1810.Pp 1811Since anchors are evaluated relative to the anchor in which they are 1812contained, there is a mechanism for accessing the parent and ancestor 1813anchors of a given anchor. 1814Similar to file system path name resolution, if the sequence 1815.Sq .. 1816appears as an anchor path component, the parent anchor of the current 1817anchor in the path evaluation at that point will become the new current 1818anchor. 1819As an example, consider the following: 1820.Bd -literal -offset indent 1821# printf 'anchor "spam/allowed"\en' | pfctl -f - 1822# printf 'anchor "../banned"\enpass\en' | pfctl -a spam/allowed -f - 1823.Ed 1824.Pp 1825Evaluation of the main ruleset will lead into the 1826spam/allowed anchor, which will evaluate the rules in the 1827spam/banned anchor, if any, before finally evaluating the 1828.Ar pass 1829rule. 1830.Sh STATEFUL FILTERING 1831.Xr pf 4 1832filters packets statefully, 1833which has several advantages. 1834For TCP connections, comparing a packet to a state involves checking 1835its sequence numbers, as well as TCP timestamps if a rule using the 1836.Ar reassemble tcp 1837parameter applies to the connection. 1838If these values are outside the narrow windows of expected 1839values, the packet is dropped. 1840This prevents spoofing attacks, such as when an attacker sends packets with 1841a fake source address/port but does not know the connection's sequence 1842numbers. 1843Similarly, 1844.Xr pf 4 1845knows how to match ICMP replies to states. 1846For example, 1847to allow echo requests (such as those created by 1848.Xr ping 8 ) 1849out statefully and match incoming echo replies correctly to states: 1850.Pp 1851.Dl pass out inet proto icmp all icmp-type echoreq 1852.Pp 1853Also, looking up states is usually faster than evaluating rules. 1854If there are 50 rules, all of them are evaluated sequentially in O(n). 1855Even with 50000 states, only 16 comparisons are needed to match a 1856state, since states are stored in a binary search tree that allows 1857searches in O(log2 n). 1858.Pp 1859Furthermore, correct handling of ICMP error messages is critical to 1860many protocols, particularly TCP. 1861.Xr pf 4 1862matches ICMP error messages to the correct connection, checks them against 1863connection parameters, and passes them if appropriate. 1864For example if an ICMP source quench message referring to a stateful TCP 1865connection arrives, it will be matched to the state and get passed. 1866.Pp 1867Finally, state tracking is required for 1868.Ar nat-to 1869and 1870.Ar rdr-to 1871options, in order to track address and port translations and reverse the 1872translation on returning packets. 1873.Pp 1874.Xr pf 4 1875will also create state for other protocols which are effectively stateless by 1876nature. 1877UDP packets are matched to states using only host addresses and ports, 1878and other protocols are matched to states using only the host addresses. 1879.Pp 1880If stateless filtering of individual packets is desired, 1881the 1882.Ar no state 1883keyword can be used to specify that state will not be created 1884if this is the last matching rule. 1885Note that packets which match neither block nor pass rules, 1886and thus are passed by default, 1887are effectively passed as if 1888.Ar no state 1889had been specified. 1890.Pp 1891A number of parameters can also be set to affect how 1892.Xr pf 4 1893handles state tracking, 1894as detailed below. 1895.Ss State Modulation 1896Much of the security derived from TCP is attributable to how well the 1897initial sequence numbers (ISNs) are chosen. 1898Some popular stack implementations choose 1899.Em very 1900poor ISNs and thus are normally susceptible to ISN prediction exploits. 1901By applying a 1902.Ar modulate state 1903rule to a TCP connection, 1904.Xr pf 4 1905will create a high quality random sequence number for each connection 1906endpoint. 1907.Pp 1908The 1909.Ar modulate state 1910directive implicitly keeps state on the rule and is 1911only applicable to TCP connections. 1912.Pp 1913For instance: 1914.Bd -literal -offset indent 1915block all 1916pass out proto tcp from any to any modulate state 1917pass in proto tcp from any to any port 25 flags S/SFRA \e 1918 modulate state 1919.Ed 1920.Pp 1921Note that modulated connections will not recover when the state table 1922is lost (firewall reboot, flushing the state table, etc.). 1923.Xr pf 4 1924will not be able to infer a connection again after the state table flushes 1925the connection's modulator. 1926When the state is lost, the connection may be left dangling until the 1927respective endpoints time out the connection. 1928It is possible on a fast local network for the endpoints to start an ACK 1929storm while trying to resynchronize after the loss of the modulator. 1930The default 1931.Ar flags 1932settings (or a more strict equivalent) should be used on 1933.Ar modulate state 1934rules to prevent ACK storms. 1935.Pp 1936Note that alternative methods are available 1937to prevent loss of the state table 1938and allow for firewall failover. 1939See 1940.Xr carp 4 1941and 1942.Xr pfsync 4 1943for further information. 1944.Ss SYN Proxy 1945By default, 1946.Xr pf 4 1947passes packets that are part of a 1948TCP handshake between the endpoints. 1949The 1950.Ar synproxy state 1951option can be used to cause 1952.Xr pf 4 1953itself to complete the handshake with the active endpoint, perform a handshake 1954with the passive endpoint, and then forward packets between the endpoints. 1955.Pp 1956No packets are sent to the passive endpoint before the active endpoint has 1957completed the handshake, hence so-called SYN floods with spoofed source 1958addresses will not reach the passive endpoint, as the sender can't complete the 1959handshake. 1960.Pp 1961The proxy is transparent to both endpoints; they each see a single 1962connection from/to the other endpoint. 1963.Xr pf 4 1964chooses random initial sequence numbers for both handshakes. 1965Once the handshakes are completed, the sequence number modulators 1966(see previous section) are used to translate further packets of the 1967connection. 1968.Ar synproxy state 1969includes 1970.Ar modulate state . 1971.Pp 1972Rules with 1973.Ar synproxy 1974will not work if 1975.Xr pf 4 1976operates on a 1977.Xr bridge 4 . 1978.Pp 1979Example: 1980.Bd -literal -offset indent 1981pass in proto tcp from any to any port www synproxy state 1982.Ed 1983.Ss Stateful Tracking Options 1984A number of options related to stateful tracking can be applied on a 1985per-rule basis. 1986One of 1987.Ar keep state , 1988.Ar modulate state , 1989or 1990.Ar synproxy state 1991must be specified explicitly to apply these options to a rule. 1992.Pp 1993.Bl -tag -width xxxx -compact 1994.It Ar floating 1995States can match packets on any interfaces 1996(the opposite of 1997.Ar if-bound ) . 1998This is the default. 1999.It Ar if-bound 2000States are bound to an interface 2001(the opposite of 2002.Ar floating ) . 2003.It Ar max Aq Ar number 2004Limits the number of concurrent states the rule may create. 2005When this limit is reached, further packets that would create 2006state are dropped until existing states time out. 2007.It Ar no-sync 2008Prevent state changes for states created by this rule from appearing on the 2009.Xr pfsync 4 2010interface. 2011.It Ar pflow 2012States created by this rule are exported on the 2013.Xr pflow 4 2014interface. 2015.It Ar sloppy 2016Uses a sloppy TCP connection tracker that does not check sequence 2017numbers at all, which makes insertion and ICMP teardown attacks way 2018easier. 2019This is intended to be used in situations where one does not see all 2020packets of a connection, e.g. in asymmetric routing situations. 2021It cannot be used with 2022.Ar modulate 2023or 2024.Ar synproxy state . 2025.It Xo Aq Ar timeout 2026.Aq Ar seconds 2027.Xc 2028Changes the timeout values used for states created by this rule. 2029For a list of all valid timeout names, see 2030.Sx OPTIONS 2031above. 2032.El 2033.Pp 2034Multiple options can be specified, separated by commas: 2035.Bd -literal -offset indent 2036pass in proto tcp from any to any \e 2037 port www keep state \e 2038 (max 100, source-track rule, max-src-nodes 75, \e 2039 max-src-states 3, tcp.established 60, tcp.closing 5) 2040.Ed 2041.Pp 2042When the 2043.Ar source-track 2044keyword is specified, the number of states per source IP is tracked. 2045.Pp 2046.Bl -tag -width xxxx -compact 2047.It Ar source-track global 2048The number of states created by all rules that use this option is limited. 2049Each rule can specify different 2050.Ar max-src-nodes 2051and 2052.Ar max-src-states 2053options, however state entries created by any participating rule count towards 2054each individual rule's limits. 2055.It Ar source-track rule 2056The maximum number of states created by this rule is limited by the rule's 2057.Ar max-src-nodes 2058and 2059.Ar max-src-states 2060options. 2061Only state entries created by this particular rule count toward the rule's 2062limits. 2063.El 2064.Pp 2065The following limits can be set: 2066.Pp 2067.Bl -tag -width xxxx -compact 2068.It Ar max-src-nodes Aq Ar number 2069Limits the maximum number of source addresses which can simultaneously 2070have state table entries. 2071.It Ar max-src-states Aq Ar number 2072Limits the maximum number of simultaneous state entries that a single 2073source address can create with this rule. 2074.El 2075.Pp 2076For stateful TCP connections, limits on established connections (connections 2077which have completed the TCP 3-way handshake) can also be enforced 2078per source IP. 2079.Pp 2080.Bl -tag -width xxxx -compact 2081.It Ar max-src-conn Aq Ar number 2082Limits the maximum number of simultaneous TCP connections which have 2083completed the 3-way handshake that a single host can make. 2084.It Xo Ar max-src-conn-rate Aq Ar number 2085.No / Aq Ar seconds 2086.Xc 2087Limit the rate of new connections over a time interval. 2088The connection rate is an approximation calculated as a moving average. 2089.El 2090.Pp 2091When one of these limits is reached, further packets that would create 2092state are dropped until existing states time out. 2093.Pp 2094Because the 3-way handshake ensures that the source address is not being 2095spoofed, more aggressive action can be taken based on these limits. 2096With the 2097.Ar overload Aq Ar table 2098state option, source IP addresses which hit either of the limits on 2099established connections will be added to the named table. 2100This table can be used in the ruleset to block further activity from 2101the offending host, redirect it to a tarpit process, or restrict its 2102bandwidth. 2103.Pp 2104The optional 2105.Ar flush 2106keyword kills all states created by the matching rule which originate 2107from the host which exceeds these limits. 2108The 2109.Ar global 2110modifier to the flush command kills all states originating from the 2111offending host, regardless of which rule created the state. 2112.Pp 2113For example, the following rules will protect the webserver against 2114hosts making more than 100 connections in 10 seconds. 2115Any host which connects faster than this rate will have its address added 2116to the 2117.Aq bad_hosts 2118table and have all states originating from it flushed. 2119Any new packets arriving from this host will be dropped unconditionally 2120by the block rule. 2121.Bd -literal -offset indent 2122block quick from \*(Ltbad_hosts\*(Gt 2123pass in on $ext_if proto tcp to $webserver port www keep state \e 2124 (max-src-conn-rate 100/10, overload \*(Ltbad_hosts\*(Gt flush global) 2125.Ed 2126.Sh TRAFFIC NORMALISATION 2127Traffic normalisation is a broad umbrella term 2128for aspects of the packet filter which deal with 2129verifying packets, packet fragments, spoof traffic, 2130and other irregularities. 2131.Ss Scrub 2132Scrub involves sanitising packet content in such a way 2133that there are no ambiguities in packet interpretation on the receiving side. 2134It is invoked with the 2135.Ar scrub 2136option, added to regular rules. 2137.Pp 2138Parameters are specified enclosed in parentheses. 2139At least one of the following parameters must be specified: 2140.Bl -tag -width xxxx 2141.It Ar max-mss Aq Ar number 2142Enforces a maximum segment size (MSS) for matching TCP packets. 2143.It Ar min-ttl Aq Ar number 2144Enforces a minimum TTL for matching IP packets. 2145.It Ar no-df 2146Clears the 2147.Ar dont-fragment 2148bit from a matching IPv4 packet. 2149Some operating systems have NFS implementations 2150which are known to generate fragmented packets with the 2151.Ar dont-fragment 2152bit set. 2153.Xr pf 4 2154will drop such fragmented 2155.Ar dont-fragment 2156packets unless 2157.Ar no-df 2158is specified. 2159.Pp 2160Unfortunately some operating systems also generate their 2161.Ar dont-fragment 2162packets with a zero IP identification field. 2163Clearing the 2164.Ar dont-fragment 2165bit on packets with a zero IP ID may cause deleterious results if an 2166upstream router later fragments the packet. 2167Using 2168.Ar random-id 2169is recommended in combination with 2170.Ar no-df 2171to ensure unique IP identifiers. 2172.It Ar random-id 2173Replaces the IPv4 identification field with random values to compensate 2174for predictable values generated by many hosts. 2175This option only applies to packets that are not fragmented 2176after the optional fragment reassembly. 2177.It Ar reassemble tcp 2178Statefully normalises TCP connections. 2179.Ar reassemble tcp 2180performs the following normalisations: 2181.Bl -ohang 2182.It TTL 2183Neither side of the connection is allowed to reduce their IP TTL. 2184An attacker may send a packet such that it reaches the firewall, affects 2185the firewall state, and expires before reaching the destination host. 2186.Ar reassemble tcp 2187will raise the TTL of all packets back up to the highest value seen on 2188the connection. 2189.It Timestamp Modulation 2190Modern TCP stacks will send a timestamp on every TCP packet and echo 2191the other endpoint's timestamp back to them. 2192Many operating systems will merely start the timestamp at zero when 2193first booted, and increment it several times a second. 2194The uptime of the host can be deduced by reading the timestamp and multiplying 2195by a constant. 2196Also observing several different timestamps can be used to count hosts 2197behind a NAT device. 2198And spoofing TCP packets into a connection requires knowing or guessing 2199valid timestamps. 2200Timestamps merely need to be monotonically increasing and not derived off a 2201guessable base time. 2202.Ar reassemble tcp 2203will cause 2204.Ar scrub 2205to modulate the TCP timestamps with a random number. 2206.It Extended PAWS Checks 2207There is a problem with TCP on long fat pipes, in that a packet might get 2208delayed for longer than it takes the connection to wrap its 32-bit sequence 2209space. 2210In such an occurrence, the old packet would be indistinguishable from a 2211new packet and would be accepted as such. 2212The solution to this is called PAWS: Protection Against Wrapped Sequence 2213numbers. 2214It protects against it by making sure the timestamp on each packet does 2215not go backwards. 2216.Ar reassemble tcp 2217also makes sure the timestamp on the packet does not go forward more 2218than the RFC allows. 2219By doing this, 2220.Xr pf 4 2221artificially extends the security of TCP sequence numbers by 10 to 18 2222bits when the host uses appropriately randomized timestamps, since a 2223blind attacker would have to guess the timestamp as well. 2224.El 2225.El 2226.Pp 2227For example: 2228.Pp 2229.Dl match in all scrub (no-df random-id max-mss 1440) 2230.Ss Fragment Handling 2231The size of IP datagrams (packets) can be significantly larger than the 2232maximum transmission unit (MTU) of the network. 2233In cases when it is necessary or more efficient to send such large packets, 2234the large packet will be fragmented into many smaller packets that will each 2235fit onto the wire. 2236Unfortunately for a firewalling device, only the first logical fragment will 2237contain the necessary header information for the subprotocol that allows 2238.Xr pf 4 2239to filter on things such as TCP ports or to perform NAT. 2240.Pp 2241One alternative is to filter individual fragments with filter rules. 2242If packet reassembly is turned off, it is passed to the filter. 2243Filter rules with matching IP header parameters decide whether the 2244fragment is passed or blocked, in the same way as complete packets 2245are filtered. 2246Without reassembly, fragments can only be filtered based on IP header 2247fields (source/destination address, protocol), since subprotocol header 2248fields are not available (TCP/UDP port numbers, ICMP code/type). 2249The 2250.Ar fragment 2251option can be used to restrict filter rules to apply only to 2252fragments, but not complete packets. 2253Filter rules without the 2254.Ar fragment 2255option still apply to fragments, if they only specify IP header fields. 2256For instance: 2257.Bd -literal -offset indent 2258pass in proto tcp from any to any port 80 2259.Ed 2260.Pp 2261The rule above never applies to a fragment, 2262even if the fragment is part of a TCP packet with destination port 80, 2263because without reassembly this information 2264is not available for each fragment. 2265This also means that fragments cannot create new or match existing 2266state table entries, which makes stateful filtering and address 2267translation (NAT, redirection) for fragments impossible. 2268.Pp 2269In most cases, the benefits of reassembly outweigh the additional 2270memory cost, 2271so reassembly is on by default. 2272.Pp 2273The memory allocated for fragment caching can be limited using 2274.Xr pfctl 8 . 2275Once this limit is reached, fragments that would have to be cached 2276are dropped until other entries time out. 2277The timeout value can also be adjusted. 2278.Pp 2279When forwarding reassembled IPv6 packets, pf refragments them with 2280the original maximum fragment size. 2281This allows the sender to determine the optimal fragment size by 2282path MTU discovery. 2283.Ss Blocking Spoofed Traffic 2284Spoofing is the faking of IP addresses, 2285typically for malicious purposes. 2286The 2287.Ar antispoof 2288directive expands to a set of filter rules which will block all 2289traffic with a source IP from the network(s) directly connected 2290to the specified interface(s) from entering the system through 2291any other interface. 2292.Pp 2293For example: 2294.Dl antispoof for lo0 2295.Pp 2296Expands to: 2297.Bd -literal -offset indent -compact 2298block drop in on ! lo0 inet from 127.0.0.1/8 to any 2299block drop in on ! lo0 inet6 from ::1 to any 2300.Ed 2301.Pp 2302For non-loopback interfaces, there are additional rules to block incoming 2303packets with a source IP address identical to the interface's IP(s). 2304For example, assuming the interface wi0 had an IP address of 10.0.0.1 and a 2305netmask of 255.255.255.0: 2306.Pp 2307.Dl antispoof for wi0 inet 2308.Pp 2309Expands to: 2310.Bd -literal -offset indent -compact 2311block drop in on ! wi0 inet from 10.0.0.0/24 to any 2312block drop in inet from 10.0.0.1 to any 2313.Ed 2314.Pp 2315Caveat: Rules created by the 2316.Ar antispoof 2317directive interfere with packets sent over loopback interfaces 2318to local addresses. 2319One should pass these explicitly. 2320.Sh OPERATING SYSTEM FINGERPRINTING 2321Passive OS fingerprinting is a mechanism to inspect nuances of a TCP 2322connection's initial SYN packet and guess at the host's operating system. 2323Unfortunately these nuances are easily spoofed by an attacker so the 2324fingerprint is not useful in making security decisions. 2325But the fingerprint is typically accurate enough to make policy decisions 2326upon. 2327.Pp 2328The fingerprints may be specified by operating system class, by 2329version, or by subtype/patchlevel. 2330The class of an operating system is typically the vendor or genre 2331and would be 2332.Ox 2333for the 2334.Xr pf 4 2335firewall itself. 2336The version of the oldest available 2337.Ox 2338release on the main FTP site 2339would be 2.6 and the fingerprint would be written as: 2340.Pp 2341.Dl \&"OpenBSD 2.6\&" 2342.Pp 2343The subtype of an operating system is typically used to describe the 2344patchlevel if that patch led to changes in the TCP stack behavior. 2345In the case of 2346.Ox , 2347the only subtype is for a fingerprint that was 2348normalised by the 2349.Ar no-df 2350scrub option and would be specified as: 2351.Pp 2352.Dl \&"OpenBSD 3.3 no-df\&" 2353.Pp 2354Fingerprints for most popular operating systems are provided by 2355.Xr pf.os 5 . 2356Once 2357.Xr pf 4 2358is running, a complete list of known operating system fingerprints may 2359be listed by running: 2360.Pp 2361.Dl # pfctl -so 2362.Pp 2363Filter rules can enforce policy at any level of operating system specification 2364assuming a fingerprint is present. 2365Policy could limit traffic to approved operating systems or even ban traffic 2366from hosts that aren't at the latest service pack. 2367.Pp 2368The 2369.Ar unknown 2370class can also be used as the fingerprint which will match packets for 2371which no operating system fingerprint is known. 2372.Pp 2373Examples: 2374.Bd -literal -offset indent 2375pass out proto tcp from any os OpenBSD 2376block out proto tcp from any os Doors 2377block out proto tcp from any os "Doors PT" 2378block out proto tcp from any os "Doors PT SP3" 2379block out from any os "unknown" 2380pass on lo0 proto tcp from any os "OpenBSD 3.3 lo0" 2381.Ed 2382.Pp 2383Operating system fingerprinting is limited only to the TCP SYN packet. 2384This means that it will not work on other protocols and will not match 2385a currently established connection. 2386.Pp 2387Caveat: operating system fingerprints are occasionally wrong. 2388There are three problems: an attacker can trivially craft his packets to 2389appear as any operating system he chooses; 2390an operating system patch could change the stack behavior and no fingerprints 2391will match it until the database is updated; 2392and multiple operating systems may have the same fingerprint. 2393.Sh EXAMPLES 2394In this example, 2395the external interface is kue0. 2396We use a macro for the interface name, so it can be changed easily. 2397All incoming traffic is "normalised", 2398and everything is blocked and logged by default. 2399.Bd -literal -offset 4n 2400ext_if = "kue0" 2401match in all scrub (no-df max-mss 1440) 2402block return log on $ext_if all 2403.Ed 2404.Pp 2405Here we specifically block packets we don't want: 2406anything coming from source we have no back routes for; 2407packets whose ingress interface does not match the one in 2408the route back to their source address; 2409anything that does not have our address (157.161.48.183) as source; 2410broadcasts (cable modem noise); 2411and anything from reserved address space or invalid addresses. 2412.Bd -literal -offset 4n 2413block in from no-route to any 2414block in from urpf-failed to any 2415block out log quick on $ext_if from ! 157.161.48.183 to any 2416block in quick on $ext_if from any to 255.255.255.255 2417block in log quick on $ext_if from { 10.0.0.0/8, 172.16.0.0/12, \e 2418 192.168.0.0/16, 255.255.255.255/32 } to any 2419.Ed 2420.Pp 2421For ICMP, 2422pass out/in ping queries. 2423State matching is done on host addresses and ICMP ID (not type/code), 2424so replies (like 0/0 for 8/0) will match queries. 2425ICMP error messages (which always refer to a TCP/UDP packet) 2426are handled by the TCP/UDP states. 2427.Bd -literal -offset 4n 2428pass on $ext_if inet proto icmp all icmp-type 8 code 0 2429.Ed 2430.Pp 2431For UDP, 2432pass out all UDP connections. 2433DNS connections are passed in. 2434.Bd -literal -offset 4n 2435pass out on $ext_if proto udp all 2436pass in on $ext_if proto udp from any to any port domain 2437.Ed 2438.Pp 2439For TCP, 2440pass out all TCP connections and modulate state. 2441SSH, SMTP, DNS, and IDENT connections are passed in. 2442We do not allow Windows 9x SMTP connections since they are typically 2443a viral worm. 2444.Bd -literal -offset 4n 2445pass out on $ext_if proto tcp all modulate state 2446pass in on $ext_if proto tcp from any to any \e 2447 port { ssh, smtp, domain, auth } 2448block in on $ext_if proto tcp from any \e 2449 os { "Windows 95", "Windows 98" } to any port smtp 2450.Ed 2451.Pp 2452Here we pass in/out all IPv6 traffic: 2453note that we have to enable this in two different ways, 2454on both our physical interface and our tunnel. 2455.Bd -literal -offset 4n 2456pass quick on gif0 inet6 2457pass quick on $ext_if proto ipv6 2458.Ed 2459.Pp 2460This example illustrates packet tagging. 2461There are three interfaces: $int_if, $ext_if, and $wifi_if (wireless). 2462NAT is being done on $ext_if for all outgoing packets. 2463Packets in on $int_if are tagged and passed out on $ext_if. 2464All other outgoing packets 2465(i.e. packets from the wireless network) 2466are only permitted to access port 80. 2467.Bd -literal -offset 4n 2468pass in on $int_if from any to any tag INTNET 2469pass in on $wifi_if from any to any 2470 2471block out on $ext_if from any to any 2472pass out quick on $ext_if tagged INTNET 2473pass out on $ext_if proto tcp from any to any port 80 2474.Ed 2475.Pp 2476In this example, 2477we tag incoming packets as they are redirected to spamd(8). 2478The tag is used to pass those packets through the packet filter. 2479.Bd -literal -offset 4n 2480match in on $ext_if inet proto tcp from \*(Ltspammers\*(Gt to port smtp \e 2481 tag SPAMD rdr-to 127.0.0.1 port spamd 2482 2483block in on $ext_if 2484pass in on $ext_if inet proto tcp tagged SPAMD 2485.Ed 2486.Pp 2487This example maps incoming requests on port 80 to port 8080, on 2488which a daemon is running (because, for example, it is not run as root, 2489and therefore lacks permission to bind to port 80). 2490.Bd -literal -offset 4n 2491match in on $ext_if proto tcp from any to any port 80 \e 2492 rdr-to 127.0.0.1 port 8080 2493.Ed 2494.Pp 2495If a 2496.Ar pass 2497rule is used with the 2498.Ar quick 2499modifier, packets matching the translation rule are passed without 2500inspecting subsequent filter rules. 2501.Bd -literal -offset 4n 2502pass in quick on $ext_if proto tcp from any to any port 80 \e 2503 rdr-to 127.0.0.1 port 8080 2504.Ed 2505.Pp 2506In the example below, vlan12 is configured as 192.168.168.1; 2507the machine translates all packets coming from 192.168.168.0/24 to 204.92.77.111 2508when they are going out any interface except vlan12. 2509This has the net effect of making traffic from the 192.168.168.0/24 2510network appear as though it is the Internet routable address 2511204.92.77.111 to nodes behind any interface on the router except 2512for the nodes on vlan12. 2513Thus, 192.168.168.1 can talk to the 192.168.168.0/24 nodes. 2514.Bd -literal -offset 4n 2515match out on ! vlan12 from 192.168.168.0/24 to any nat-to 204.92.77.111 2516.Ed 2517.Pp 2518In the example below, the machine sits between a fake internal 2519144.19.74.* network, and a routable external IP of 204.92.77.100. 2520The last rule excludes protocol AH from being translated. 2521.Bd -literal -offset 4n 2522pass out on $ext_if from 144.19.74.0/24 nat-to 204.92.77.100 2523pass out on $ext_if proto ah from 144.19.74.0/24 2524.Ed 2525.Pp 2526In the example below, packets bound for one specific server, as well as those 2527generated by the sysadmins are not proxied; all other connections are. 2528.Bd -literal -offset 4n 2529pass in on $int_if proto { tcp, udp } from any to any port 80 \e 2530 rdr-to 127.0.0.1 port 80 2531pass in on $int_if proto { tcp, udp } from any to $server port 80 2532pass in on $int_if proto { tcp, udp } from $sysadmins to any port 80 2533.Ed 2534.Pp 2535This example maps outgoing packets' source port 2536to an assigned proxy port instead of an arbitrary port. 2537In this case, proxy outgoing isakmp with port 500 on the gateway. 2538.Bd -literal -offset 4n 2539match out on $ext_if inet proto udp from any port isakmp to any \e 2540 nat-to ($ext_if) port 500 2541.Ed 2542.Pp 2543One more example uses 2544.Ar rdr-to 2545to redirect a TCP and UDP port to an internal machine. 2546.Bd -literal -offset 4n 2547match in on $ext_if inet proto tcp from any to ($ext_if) port 8080 \e 2548 rdr-to 10.1.2.151 port 22 2549match in on $ext_if inet proto udp from any to ($ext_if) port 8080 \e 2550 rdr-to 10.1.2.151 port 53 2551.Ed 2552.Pp 2553In this example, a NAT gateway is set up to translate internal addresses 2554using a pool of public addresses (192.0.2.16/28). 2555A given source address is always translated to the same pool address by 2556using the source-hash keyword. 2557The gateway also translates incoming web server connections 2558to a group of web servers on the internal network. 2559.Bd -literal -offset 4n 2560match out on $ext_if inet from any to any nat-to 192.0.2.16/28 \e 2561 source-hash 2562match in on $ext_if proto tcp from any to any port 80 \e 2563 rdr-to { 10.1.2.155 weight 2, 10.1.2.160 weight 1, \e 2564 10.1.2.161 weight 8 } round-robin 2565.Ed 2566.Pp 2567The bidirectional address translation example uses a single 2568.Ar binat-to 2569rule that expands to a 2570.Ar nat-to 2571and an 2572.Ar rdr-to 2573rule. 2574.Bd -literal -offset 4n 2575pass on $ext_if from 10.1.2.120 to any binat-to 192.0.2.17 2576.Ed 2577.Pp 2578The previous example is identical to the following set of rules: 2579.Bd -literal -offset 4n 2580pass out on $ext_if inet from 10.1.2.120 to any \e 2581 nat-to 192.0.2.17 static-port 2582pass in on $ext_if inet from any to 192.0.2.17 rdr-to 10.1.2.120 2583.Ed 2584.Pp 2585In the example below, a router handling both address families 2586translates an internal IPv4 subnet to IPv6 using the well-known 258764:ff9b::/96 prefix: 2588.Bd -literal -offset 4n 2589pass in on $v4_if inet af-to inet6 from ($v6_if) to 64:ff9b::/96 2590.Ed 2591.Pp 2592Paired with the example above, the example below can be used on 2593another router handling both address families to translate back 2594to IPv4: 2595.Bd -literal -offset 4n 2596pass in on $v6_if inet6 to 64:ff9b::/96 af-to inet from ($v4_if) 2597.Ed 2598.Sh GRAMMAR 2599Syntax for 2600.Nm 2601in BNF: 2602.Bd -literal 2603line = ( option | pf-rule | 2604 antispoof-rule | queue-rule | anchor-rule | 2605 anchor-close | load-anchor | table-rule | include ) 2606 2607option = "set" ( [ "timeout" ( timeout | "{" timeout-list "}" ) ] | 2608 [ "ruleset-optimization" [ "none" | "basic" | 2609 "profile" ] ] | 2610 [ "optimization" [ "default" | "normal" | "high-latency" | 2611 "satellite" | "aggressive" | "conservative" ] ] 2612 [ "limit" ( limit-item | "{" limit-list "}" ) ] | 2613 [ "loginterface" ( interface-name | "none" ) ] | 2614 [ "block-policy" ( "drop" | "return" ) ] | 2615 [ "state-policy" ( "if-bound" | "floating" ) ] 2616 [ "state-defaults" state-opts ] 2617 [ "fingerprints" filename ] | 2618 [ "skip on" ifspec ] | 2619 [ "debug" ( "none" | "urgent" | "misc" | "loud" ) ] | 2620 [ "reassemble" ( "yes" | "no" ) [ "no-df" ] ] ) 2621 2622pf-rule = action [ ( "in" | "out" ) ] 2623 [ "log" [ "(" logopts ")"] ] [ "quick" ] 2624 [ "on" ( ifspec | "rdomain" number ) ] [ af ] 2625 [ protospec ] hosts [ filteropts ] 2626 2627logopts = logopt [ [ "," ] logopts ] 2628logopt = "all" | "matches" | "user" | "to" interface-name 2629 2630filteropts = filteropt [ [ "," ] filteropts ] 2631filteropt = user | group | flags | icmp-type | icmp6-type | 2632 "tos" tos | 2633 ( "no" | "keep" | "modulate" | "synproxy" ) "state" 2634 [ "(" state-opts ")" ] | "scrub" "(" scrubopts ")" | 2635 "fragment" | "allow-opts" | "once" | 2636 "divert-packet" "port" port | "divert-reply" | 2637 "divert-to" host "port" port | 2638 "label" string | "tag" string | [ ! ] "tagged" string | 2639 "set prio" ( number | "(" number [ [ "," ] number ] ")" ) | 2640 "set queue" ( string | "(" string [ [ "," ] string ] ")" ) | 2641 "rtable" number | "probability" number"%" | 2642 "af-to" af "from" ( redirhost | "{" redirhost-list "}" ) 2643 [ "to" ( redirhost | "{" redirhost-list "}" ) ] | 2644 "binat-to" ( redirhost | "{" redirhost-list "}" ) 2645 [ portspec ] [ pooltype ] | 2646 "rdr-to" ( redirhost | "{" redirhost-list "}" ) 2647 [ portspec ] [ pooltype ] | 2648 "nat-to" ( redirhost | "{" redirhost-list "}" ) 2649 [ portspec ] [ pooltype ] [ "static-port" ] | 2650 [ route ] | [ "set tos" tos ] | 2651 [ [ "!" ] "received-on" ( interface-name | interface-group ) ] 2652 2653scrubopts = scrubopt [ [ "," ] scrubopts ] 2654scrubopt = "no-df" | "min-ttl" number | "max-mss" number | 2655 "reassemble tcp" | "random-id" 2656 2657antispoof-rule = "antispoof" [ "log" ] [ "quick" ] 2658 "for" ifspec [ af ] [ "label" string ] 2659 2660table-rule = "table" "\*(Lt" string "\*(Gt" [ tableopts ] 2661tableopts = tableopt [ tableopts ] 2662tableopt = "persist" | "const" | "counters" | 2663 "file" string | "{" [ tableaddrs ] "}" 2664tableaddrs = tableaddr-spec [ [ "," ] tableaddrs ] 2665tableaddr-spec = [ "!" ] tableaddr [ "/" mask-bits ] 2666tableaddr = hostname | ifspec | "self" | 2667 ipv4-dotted-quad | ipv6-coloned-hex 2668 2669queue-rule = "queue" string [ "on" interface-name ] queueopts-list 2670 2671anchor-rule = "anchor" [ string ] [ ( "in" | "out" ) ] [ "on" ifspec ] 2672 [ af ] [ protospec ] [ hosts ] [ filteropt-list ] [ "{" ] 2673 2674anchor-close = "}" 2675 2676load-anchor = "load anchor" string "from" filename 2677 2678queueopts-list = queueopts-list queueopts | queueopts 2679queueopts = [ "bandwidth" bandwidth ] | [ "min" bandwidth ] | 2680 [ "max" bandwidth ] | [ "parent" string ] | 2681 [ "default" ] | [ "qlimit" number ] 2682bandwidth = bandwidth-spec [ "burst" bandwidth-spec "for" number "ms" ] 2683bandwidth-spec = number ( "" | "K" | "M" | "G" ) 2684 2685action = "pass" | "match" | "block" [ return ] 2686return = "drop" | "return" | 2687 "return-rst" [ "(" "ttl" number ")" ] | 2688 "return-icmp" [ "(" icmpcode [ [ "," ] icmp6code ] ")" ] | 2689 "return-icmp6" [ "(" icmp6code ")" ] 2690icmpcode = ( icmp-code-name | icmp-code-number ) 2691icmp6code = ( icmp6-code-name | icmp6-code-number ) 2692 2693ifspec = ( [ "!" ] ( interface-name | interface-group ) ) | 2694 "{" interface-list "}" 2695interface-list = [ "!" ] ( interface-name | interface-group ) 2696 [ [ "," ] interface-list ] 2697route = ( "route-to" | "reply-to" | "dup-to" ) 2698 ( routehost | "{" routehost-list "}" ) 2699 [ pooltype ] 2700af = "inet" | "inet6" 2701 2702protospec = "proto" ( proto-name | proto-number | 2703 "{" proto-list "}" ) 2704proto-list = ( proto-name | proto-number ) [ [ "," ] proto-list ] 2705 2706hosts = "all" | 2707 "from" ( "any" | "no-route" | "urpf-failed" | "self" | 2708 host | "{" host-list "}" | "route" string ) [ port ] 2709 [ os ] 2710 "to" ( "any" | "no-route" | "self" | host | 2711 "{" host-list "}" | "route" string ) [ port ] 2712 2713ipspec = "any" | host | "{" host-list "}" 2714host = [ "!" ] ( address [ "weight" number ] | 2715 address [ "/" mask-bits ] [ "weight" number ] | 2716 "\*(Lt" string "\*(Gt" ) 2717redirhost = address [ "/" mask-bits ] 2718routehost = host | host "@" interface-name | 2719 "(" interface-name [ address [ "/" mask-bits ] ] ")" 2720address = ( interface-name | interface-group | 2721 "(" ( interface-name | interface-group ) ")" | 2722 hostname | ipv4-dotted-quad | ipv6-coloned-hex ) 2723host-list = host [ [ "," ] host-list ] 2724redirhost-list = redirhost [ [ "," ] redirhost-list ] 2725routehost-list = routehost [ [ "," ] routehost-list ] 2726 2727port = "port" ( unary-op | binary-op | "{" op-list "}" ) 2728portspec = "port" ( number | name ) [ ":" ( "*" | number | name ) ] 2729os = "os" ( os-name | "{" os-list "}" ) 2730user = "user" ( unary-op | binary-op | "{" op-list "}" ) 2731group = "group" ( unary-op | binary-op | "{" op-list "}" ) 2732 2733unary-op = [ "=" | "!=" | "\*(Lt" | "\*(Le" | "\*(Gt" | "\*(Ge" ] 2734 ( name | number ) 2735binary-op = number ( "\*(Lt\*(Gt" | "\*(Gt\*(Lt" | ":" ) number 2736op-list = ( unary-op | binary-op ) [ [ "," ] op-list ] 2737 2738os-name = operating-system-name 2739os-list = os-name [ [ "," ] os-list ] 2740 2741flags = "flags" ( [ flag-set ] "/" flag-set | "any" ) 2742flag-set = [ "F" ] [ "S" ] [ "R" ] [ "P" ] [ "A" ] [ "U" ] [ "E" ] 2743 [ "W" ] 2744 2745icmp-type = "icmp-type" ( icmp-type-code | "{" icmp-list "}" ) 2746icmp6-type = "icmp6-type" ( icmp-type-code | "{" icmp-list "}" ) 2747icmp-type-code = ( icmp-type-name | icmp-type-number ) 2748 [ "code" ( icmp-code-name | icmp-code-number ) ] 2749icmp-list = icmp-type-code [ [ "," ] icmp-list ] 2750 2751tos = ( "lowdelay" | "throughput" | "reliability" | 2752 [ "0x" ] number ) 2753 2754state-opts = state-opt [ [ "," ] state-opts ] 2755state-opt = ( "max" number | "no-sync" | timeout | "sloppy" | 2756 "pflow" | "source-track" [ ( "rule" | "global" ) ] | 2757 "max-src-nodes" number | "max-src-states" number | 2758 "max-src-conn" number | 2759 "max-src-conn-rate" number "/" number | 2760 "overload" "\*(Lt" string "\*(Gt" [ "flush" [ "global" ] ] | 2761 "if-bound" | "floating" ) 2762 2763timeout-list = timeout [ [ "," ] timeout-list ] 2764timeout = ( "tcp.first" | "tcp.opening" | "tcp.established" | 2765 "tcp.closing" | "tcp.finwait" | "tcp.closed" | 2766 "udp.first" | "udp.single" | "udp.multiple" | 2767 "icmp.first" | "icmp.error" | 2768 "other.first" | "other.single" | "other.multiple" | 2769 "frag" | "interval" | "src.track" | 2770 "adaptive.start" | "adaptive.end" ) number 2771 2772limit-list = limit-item [ [ "," ] limit-list ] 2773limit-item = ( "states" | "frags" | "src-nodes" | "tables" | 2774 "table-entries" ) number 2775 2776pooltype = ( "bitmask" | "least-states" | 2777 "random" | "round-robin" | 2778 "source-hash" [ ( hex-key | string-key ) ] ) 2779 [ sticky-address ] 2780 2781include = "include" filename 2782.Ed 2783.Sh FILES 2784.Bl -tag -width "/etc/protocolsXXX" -compact 2785.It Pa /etc/hosts 2786Host name database. 2787.It Pa /etc/pf.conf 2788Default location of the ruleset file. 2789.It Pa /etc/pf.os 2790Default location of OS fingerprints. 2791.It Pa /etc/protocols 2792Protocol name database. 2793.It Pa /etc/services 2794Service name database. 2795.El 2796.Sh SEE ALSO 2797.Xr pf 4 , 2798.Xr pflow 4 , 2799.Xr pfsync 4 , 2800.Xr pf.os 5 , 2801.Xr pfctl 8 , 2802.Xr pflogd 8 2803.Sh HISTORY 2804The 2805.Nm 2806file format first appeared in 2807.Ox 3.0 . 2808