FreeBSD firewall using PF

FreeBSD supports OpenBSD’s powerful firewall PF since version 5.3. The scenario I was pursuing was firewalling one of my FreeBSD machines:

Incoming firewalling

  • Only incoming SSH connections from known SSH clients should be accepted.
  • Only incoming Syslog traffic from known Syslog clients should be accepted.
  • Only incoming ICMP Echo-Reply, ICMP Echo-Request and ICMP Destination-Unreachable datagrams should be accepted. Any other ICMP datagram is potentially dangerous.
  • No other incoming traffic should be allowed, but should get logged.

Outgoing firewalling

  • Only outgoing DNS queries to known DNS servers should be accepted.
  • Only outgoing NTP traffic to know NTP servers should be accepted.
  • Only outgoing ICMP Echo-Reply, ICMP Echo-Request and ICMP Destination-Unreachable datagrams should be accepted. Any other ICMP datagram is potentially dangerous.
  • No other outgoing traffic should be allowed, but should get logged.

The contents of /etc/pf.conf should look lite this:

scrub in all pass quick on lo0 all icmp_types = "{ echorep, unreach, echoreq }" syslog_sources = "{ 192.168.0.124, 192.168.0.125, 192.168.0.126 }" ssh_sources = "{ 192.168.0.90, 192.168.0.91 }" ntp_servers = "{ 192.168.0.125 }" dns_servers = "{ 192.168.0.124 }" block in log all pass in on rl0 inet proto icmp icmp-type $icmp_types keep state pass in on rl0 proto tcp from $ssh_sources to self port { 22 } flags S/SA keep state pass in on rl0 proto udp from $syslog_sources to self port { 514 } block out log all pass out on rl0 inet proto icmp icmp-type $icmp_types keep state pass out on rl0 proto udp from self to $dns_servers port { 53 } keep state pass out on rl0 proto udp from self to $ntp_servers port { 123 } keep state

To enable PF and PF logging support to start automatically during boot, the following lines should be added to /etc/rc.conf:

pf_enable="YES"
pf_rules="/etc/pf.conf"
pf_program="/sbin/pfctl"
pflog_enable="YES"
pflog_logfile="/var/log/pflog"
pflog_program="/sbin/pflogd"

Advertisements

5 thoughts on “FreeBSD firewall using PF

  1. Pingback: unix86.org » Useful FreeBSD Resources / Links

  2. To all the brave Men and Women in uniform. Thank you so much for your service and sacrifice, your blood tears and youth. Thank you for volunteering, for perservering and never giving up. Your strength gives America hope. May God bless you all.

  3. Pid can necessitate aniexty and can anecdotally withdrawabsorb to tubo-ovarian abscesses, uncoupling decrese and infertility, and italian xanax codeine paracetamol that can finalize to cytosolic pregnancy.

  4. Abby……congratulations on your decision. With God all things are possible. You opened your heart and listened to the Lord calling you. What a joy that is! You will remain in my prayers, as well as all the babies you will save in the future.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s