The Book of PF, 3rd Edition A No-Nonsense Guide to the OpenBSD Firewall (Peter N. M. Hansteen)（Z-Library）

www.nostarch.com TH E F I N EST I N G E E K E NTE RTA I N M E NT™ SHELVE IN: OPERATING SYSTEM S/UNIX $34.95 ($36.95 CDN) B U I L D A M O R E S E C U R E N E T W O R K W I T H P F OpenBSD’s stateful packet filter, PF, is the heart of the OpenBSD firewall. With more and more services placing high demands on bandwidth and an increas- ingly hostile Internet environment, no sysadmin can afford to be without PF expertise. The third edition of The Book of PF covers the most up-to-date developments in PF, including new content on IPv6, dual stack configurations, the “queues and priorities” traffic-shaping system, NAT and redirection, wireless networking, spam fighting, failover provision- ing, logging, and more. You’ll also learn how to: • Create rule sets for all kinds of network traffic, whether crossing a simple LAN, hiding behind NAT, traversing DMZs, or spanning bridges or wider networks • Set up wireless networks with access points, and lock them down using authpf and special access restrictions • Maximize flexibility and service availability via CARP, relayd, and redirection • Build adaptive firewalls to proactively defend against attackers and spammers • Harness OpenBSD’s latest traffic-shaping system to keep your network responsive, and convert your existing ALTQ configurations to the new system • Stay in control of your traffic with monitoring and visualization tools (including NetFlow) The Book of PF is the essential guide to building a secure network with PF. With a little effort and this book, you’ll be well prepared to unlock PF’s full potential. A B O U T T H E A U T H O R Peter N.M. Hansteen is a consultant, writer, and sysadmin based in Bergen, Norway. A longtime Freenix advocate, Hansteen is a frequent lecturer on OpenBSD and FreeBSD topics, an occasional contributor to BSD Magazine, and the author of an often-slashdotted blog (http://bsdly.blogspot.com/ ). Hansteen was a participant in the original RFC 1149 implementation team. The Book of PF is an expanded follow-up to his very popular online PF tutorial (http:// home.nuug.no/~peter/pf/ ). Covers OpenBSD 5.6, FreeBSD 10.x, and NetBSD 6.x P E T E R N . M . H A N S T E E N T H E B O O K O F P F A N O - N O N S E N S E G U I D E T O T H E O P E N B S D F I R E W A L L 3 R D E D I T I O N T H E B O O K O F P F T H E B O O K O F P F 3 R D E D IT IO N H A N S T E E N “ I L I E F LAT .” Th is book uses a durab le b ind ing that won’t snap shut. www.it-ebooks.info

Praise for The Book of Pf “The definitive hardcopy guide to deployment and configuration of PF firewalls, written in clear, exacting style. Its coverage is outstanding.” —Chad Perrin, TeCh rePubliC “This book is for everyone who uses PF. Regardless of operating system and skill level, this book will teach you something new and interesting.” —bSd Magazine “With Mr. Hansteen paying close attention to important topics like state inspection, SPAM, black/grey listing, and many others, this must-have reference for BSD users can go a long way to helping you fine-tune the who/what/where/when/how of access control on your BSD box.” —infoWorld “A must-have resource for anyone who deals with firewall configurations. If you’ve heard good things about PF and have been thinking of giving it a go, this book is definitely for you. Start at the beginning and before you know it you’ll be through the book and quite the PF guru. Even if you’re already a PF guru, this is still a good book to keep on the shelf to refer to in thorny situa- tions or to lend to colleagues.” —dru lavigne, auThor of BSD HackS and THe DefiniTive GuiDe To Pc-BSD “The book is a great resource and has me eager to rewrite my aging rulesets.” —;login: “This book is a super easy read. I loved it! This book easily makes my Top 5 Books list.” —daeMon neWS www.it-ebooks.info

www.it-ebooks.info

T h e B o o k o f P f 3 r d e d i T i o n A n o - n o n s e n s e G u i d e t o t h e o p e n B S d f i r e w a l l by Peter N.M. Hansteen San Francisco www.it-ebooks.info

The Book of Pf, 3rd ediTion. Copyright © 2015 by Peter N.M. Hansteen. All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the publisher. Printed in USA First printing 18 17 16 15 14 1 2 3 4 5 6 7 8 9 ISBN-10: 1-59327-589-7 ISBN-13: 978-1-59327-589-1 Publisher: William Pollock Production Editor: Serena Yang Cover and Interior Design: Octopod Studios Developmental Editor: William Pollock Technical Reviewer: Henning Brauer Copyeditor: Julianne Jigour Compositor: Susan Glinert Stevens Proofreader: Paula L. Fleming Indexer: BIM Indexing and Proofreading Services For information on distribution, translations, or bulk sales, please contact No Starch Press, Inc. directly: No Starch Press, Inc. 245 8th Street, San Francisco, CA 94103 phone: 415.863.9900; info@nostarch.com www.nostarch.com The Library of Congress has catalogued the first edition as follows: Hansteen, Peter N. M. The book of PF : a no-nonsense guide to the OpenBSD firewall / Peter N.M. Hansteen. p. cm. Includes index. ISBN-13: 978-1-59327-165-7 ISBN-10: 1-59327-165-4 1. OpenBSD (Electronic resource) 2. TCP/IP (Computer network protocol) 3. Firewalls (Computer security) I. Title. TK5105.585.H385 2008 005.8--dc22 2007042929 No Starch Press and the No Starch Press logo are registered trademarks of No Starch Press, Inc. Other product and company names mentioned herein may be the trademarks of their respective owners. Rather than use a trademark symbol with every occurrence of a trademarked name, we are using the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. The information in this book is distributed on an “As Is” basis, without warranty. While every precaution has been taken in the preparation of this work, neither the author nor No Starch Press, Inc. shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in it. www.it-ebooks.info

To Gene Scharmann, who all those years ago nudged me in the direction of free software www.it-ebooks.info

www.it-ebooks.info

B r i e f C o n T e n T S Foreword by Bob Beck (from the first edition) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xvii Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xix Chapter 1: Building the Network You Need . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Chapter 2: PF Configuration Basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Chapter 3: Into the Real World . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Chapter 4: Wireless Networks Made Easy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Chapter 5: Bigger or Trickier Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Chapter 6: Turning the Tables for Proactive Defense . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 Chapter 7: Traffic Shaping with Queues and Priorities . . . . . . . . . . . . . . . . . . . . . . . . . . 117 Chapter 8: Redundancy and Resource Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 Chapter 9: Logging, Monitoring, and Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161 Chapter 10: Getting Your Setup Just Right . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185 Appendix A: Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201 Appendix B: A Note on Hardware Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207 Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211 www.it-ebooks.info

www.it-ebooks.info

C o n T e n T S i n d e T A i l foreword by Bob Beck (from the first edition) xv AcknowledgmenTs xvii inTroducTion xix This Is Not a HOWTO . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xx What This Book Covers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xx 1 Building The neTwork You need 1 Your Network: High Performance, Low Maintenance, and Secure . . . . . . . . . . . . . . . . . 1 Where the Packet Filter Fits In . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 The Rise of PF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 If You Came from Elsewhere . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Pointers for Linux Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Frequently Answered Questions About PF . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 A Little Encouragement: A PF Haiku . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 2 Pf configurATion BAsics 11 The First Step: Enabling PF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Setting Up PF on OpenBSD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Setting Up PF on FreeBSD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Setting Up PF on NetBSD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 A Simple PF Rule Set: A Single, Stand-Alone Machine . . . . . . . . . . . . . . . . . . . . . . . . 16 A Minimal Rule Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Testing the Rule Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Slightly Stricter: Using Lists and Macros for Readability . . . . . . . . . . . . . . . . . . . . . . . . 18 A Stricter Baseline Rule Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Reloading the Rule Set and Looking for Errors . . . . . . . . . . . . . . . . . . . . . . . . 20 Checking Your Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Testing the Changed Rule Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Displaying Information About Your System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Looking Ahead . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 3 inTo The reAl world 25 A Simple Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Keep It Simple: Avoid the Pitfalls of in, out, and on . . . . . . . . . . . . . . . . . . . . 26 Network Address Translation vs . IPv6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Final Preparations: Defining Your Local Network . . . . . . . . . . . . . . . . . . . . . . 29 Setting Up a Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Testing Your Rule Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 www.it-ebooks.info

x Contents in Detail That Sad Old FTP Thing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 If We Must: ftp-proxy with Divert or Redirect . . . . . . . . . . . . . . . . . . . . . . . . . 36 Variations on the ftp-proxy Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Making Your Network Troubleshooting-Friendly . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Do We Let It All Through? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 The Easy Way Out: The Buck Stops Here . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Letting ping Through . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Helping traceroute . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Path MTU Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Tables Make Your Life Easier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 4 wireless neTworks mAde eAsY 45 A Little IEEE 802 .11 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 MAC Address Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 WEP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 WPA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 The Right Hardware for the Task . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Setting Up a Simple Wireless Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 An OpenBSD WPA Access Point . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 A FreeBSD WPA Access Point . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 The Access Point’s PF Rule Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Access Points with Three or More Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . 54 Handling IPSec, VPN Solutions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 The Client Side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 OpenBSD Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 FreeBSD Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Guarding Your Wireless Network with authpf . . . . . . . . . . . . . . . . . . . . . . . . 59 A Basic Authenticating Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Wide Open but Actually Shut . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 5 Bigger or Trickier neTworks 65 A Web Server and Mail Server on the Inside: Routable IPv4 Addresses . . . . . . . . . . . . 66 A Degree of Separation: Introducing the DMZ . . . . . . . . . . . . . . . . . . . . . . . 70 Sharing the Load: Redirecting to a Pool of Addresses . . . . . . . . . . . . . . . . . . 72 Getting Load Balancing Right with relayd . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 A Web Server and Mail Server on the Inside—The NAT Version . . . . . . . . . . . . . . . . . 79 DMZ with NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Redirection for Load Balancing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 Back to the Single NATed Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 Filtering on Interface Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 The Power of Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 The Bridging Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 Basic Bridge Setup on OpenBSD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Basic Bridge Setup on FreeBSD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Basic Bridge Setup on NetBSD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 The Bridge Rule Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 www.it-ebooks.info

Contents in Detail xi Handling Nonroutable IPv4 Addresses from Elsewhere . . . . . . . . . . . . . . . . . . . . . . . . 91 Establishing Global Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Restructuring Your Rule Set with Anchors . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 How Complicated Is Your Network?—Revisited . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 6 Turning The TABles for ProAcTive defense 95 Turning Away the Brutes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 SSH Brute-Force Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 Setting Up an Adaptive Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Tidying Your Tables with pfctl . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Giving Spammers a Hard Time with spamd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 Network-Level Behavior Analysis and Blacklisting . . . . . . . . . . . . . . . . . . . . 100 Greylisting: My Admin Told Me Not to Talk to Strangers . . . . . . . . . . . . . . . 104 Tracking Your Real Mail Connections: spamlogd . . . . . . . . . . . . . . . . . . . . 108 Greytrapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Managing Lists with spamdb . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 Detecting Out-of-Order MX Use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 Handling Sites That Do Not Play Well with Greylisting . . . . . . . . . . . . . . . . 113 Spam-Fighting Tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 7 TrAffic shAPing wiTh Queues And PrioriTies 117 Always-On Priority and Queues for Traffic Shaping . . . . . . . . . . . . . . . . . . . . . . . . . 118 Shaping by Setting Traffic Priorities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 Introducing Queues for Bandwidth Allocation . . . . . . . . . . . . . . . . . . . . . . . 121 Using Queues to Handle Unwanted Traffic . . . . . . . . . . . . . . . . . . . . . . . . . 130 Transitioning from ALTQ to Priorities and Queues . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 Directing Traffic with ALTQ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Basic ALTQ Concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Queue Schedulers, aka Queue Disciplines . . . . . . . . . . . . . . . . . . . . . . . . . 134 Setting Up ALTQ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Priority-Based Queues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Using ALTQ Priority Queues to Improve Performance . . . . . . . . . . . . . . . . . . 136 Using a match Rule for Queue Assignment . . . . . . . . . . . . . . . . . . . . . . . . . 137 Class-Based Bandwidth Allocation for Small Networks . . . . . . . . . . . . . . . . . 139 A Basic HFSC Traffic Shaper . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 Queuing for Servers in a DMZ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 Using ALTQ to Handle Unwanted Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . 144 Conclusion: Traffic Shaping for Fun, and Perhaps Even Profit . . . . . . . . . . . . . . . . . . . 145 8 redundAncY And resource AvAilABiliTY 147 Redundancy and Failover: CARP and pfsync . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 The Project Specification: A Redundant Pair of Gateways . . . . . . . . . . . . . . . 148 Setting Up CARP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 Keeping States Synchronized: Adding pfsync . . . . . . . . . . . . . . . . . . . . . . . 154 Putting Together a Rule Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 CARP for Load Balancing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157 www.it-ebooks.info

xii Contents in Detail 9 logging, moniToring, And sTATisTics 161 PF Logs: The Basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 Logging the Packet's Path Through Your Rule Set: log (matches) . . . . . . . . . . 164 Logging All Packets: log (all) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 Logging to Several pflog Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 Logging to syslog, Local or Remote . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 Tracking Statistics for Each Rule with Labels . . . . . . . . . . . . . . . . . . . . . . . . 169 Additional Tools for PF Logs and Statistics . . . . . . . . . . . . . . . . . . . . . . . . . 171 Keeping an Eye on Things with systat . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 Keeping an Eye on Things with pftop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 Graphing Your Traffic with pfstat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 Collecting NetFlow Data with pflow(4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176 Collecting NetFlow Data with pfflowd . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182 SNMP Tools and PF-Related SNMP MIBs . . . . . . . . . . . . . . . . . . . . . . . . . . 182 Log Data as the Basis for Effective Debugging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183 10 geTTing Your seTuP JusT righT 185 Things You Can Tweak and What You Probably Should Leave Alone . . . . . . . . . . . . . 185 Block Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186 Skip Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 State Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 State Defaults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 Timeouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 Limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189 Debug . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190 Rule Set Optimization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191 Optimization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192 Fragment Reassembly . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192 Cleaning Up Your Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 Packet Normalization with scrub: OpenBSD 4 .5 and Earlier . . . . . . . . . . . . 193 Packet Normalization with scrub: OpenBSD 4 .6 Onward . . . . . . . . . . . . . . 193 Protecting Against Spoofing with antispoof . . . . . . . . . . . . . . . . . . . . . . . . . 194 Testing Your Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195 Debugging Your Rule Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197 Know Your Network and Stay in Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199 A resources 201 General Networking and BSD Resources on the Internet . . . . . . . . . . . . . . . . . . . . . . 201 Sample Configurations and Related Musings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203 PF on Other BSD Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204 BSD and Networking Books . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204 Wireless Networking Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205 spamd and Greylisting-Related Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205 Book-Related Web Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206 Buy OpenBSD CDs and Donate! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206 www.it-ebooks.info

Contents in Detail xiii B A noTe on hArdwAre suPPorT 207 Getting the Right Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208 Issues Facing Hardware Support Developers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209 How to Help the Hardware Support Efforts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210 index 211 www.it-ebooks.info

www.it-ebooks.info

f o r e w o r d from the first edition OpenBSD’s PF packet filter has enjoyed a lot of success and attention since it was first released in OpenBSD 3.0 in late 2001. While you’ll find out more about PF’s history in this book, in a nutshell, PF happened because it was needed by the developers and users of OpenBSD. Since the original release, PF has evolved greatly and has become the most powerful free tool available for firewalling, load balanc- ing, and traffic managing. When PF is combined with CARP and pfsync, PF lets system administrators not only protect their services from attack, but it makes those services more reliable by allowing for redundancy, and it makes them faster by scaling them using pools of servers managed through PF and relayd. While I have been involved with PF’s development, I am first and fore- most a large-scale user of PF. I use PF for security, to manage threats both internal and external, and to help me run large pieces of critical infra- structure in a redundant and scalable manner. This saves my employer www.it-ebooks.info

xvi Foreword (the University of Alberta, where I wear the head sysadmin hat by day) money, both in terms of downtime and in terms of hardware and software. You can use PF to do the same. With these features comes the necessary evil of complexity. For some- one well versed in TCP/IP and OpenBSD, PF’s system documentation is quite extensive and usable all on its own. But in spite of extensive examples in the system documentation, it is never quite possible to put all the things you can do with PF and its related set of tools front and center without mak- ing the system documentation so large that it ceases to be useful for those experienced people who need to use it as a reference. This book bridges the gap. If you are a relative newcomer, it can get you up to speed on OpenBSD and PF. If you are a more experienced user, this book can show you some examples of the more complex applications that help people with problems beyond the scope of the typical. For sev- eral years, Peter N.M. Hansteen has been an excellent resource for people learning how to apply PF in more than just the “How do I make a firewall?” sense, and this book extends his tradition of sharing that knowledge with others. Firewalls are now ubiquitous enough that most people have one, or several. But this book is not simply about building a firewall, it is about learn- ing techniques for manipulating your network traffic and understanding those techniques enough to make your life as a system and network admin- istrator a lot easier. A simple firewall is easy to build or buy off the shelf, but a firewall you can live with and manage yourself is somewhat more complex. This book goes a long way toward flattening out the learning curve and get- ting you thinking not only about how to build a firewall, but how PF works and where its strengths can help you. This book is an investment to save you time. It will get you up and running the right way—faster, with fewer false starts and less time experimenting. Bob Beck Director, The OpenBSD Foundation http://www.openbsdfoundation.org/ Edmonton, Alberta, Canada www.it-ebooks.info

A C k n o w l e d G m e n T S This manuscript started out as a user group lecture, first presented at the January 27, 2005 meeting of the Bergen [BSD and] Linux User Group (BLUG). After I had translated the manuscript into English and expanded it slightly, Greg Lehey suggested that I should stretch it a little further and present it as a half day tutorial for the AUUG 2005 con- ference. After a series of tutorial revisions, I finally started working on what was to become the book version in early 2007. The next two paragraphs are salvaged from the tutorial manuscript and still apply to this book: This manuscript is a slightly further developed version of a manu- script prepared for a lecture which was announced as (translated from Norwegian): “This lecture is about firewalls and related functions, with examples from real life with the OpenBSD project’s PF (Packet Filter). PF offers firewalling, NAT, traffic control, and bandwidth management in a single, flexible, and sysadmin-friendly system. Peter hopes that the lecture will give you some ideas about how www.it-ebooks.info

xviii Acknowledgments to control your network traffic the way you want—keeping some things outside your network, directing traffic to specified hosts or services, and of course, giving spammers a hard time.” Some portions of content from the tutorial (and certainly all the really useful topics) made it into this book in some form. People who have offered significant and useful input regarding early versions of this manuscript include Eystein Roll Aarseth, David Snyder, Peter Postma, Henrik Kramshøj, Vegard Engen, Greg Lehey, Ian Darwin, Daniel Hartmeier, Mark Uemura, Hallvor Engen, and probably a few who will remain lost in my mail archive until I can grep them out of there. I would like to thank the following organizations for their kind support: the NUUG Foundation for a travel grant, which partly financed my AUUG 2005 appearance; the AUUG, UKUUG, SANE, BSDCan, AsiaBSDCon, NUUG, BLUG and BSD-DK organizations for inviting me to speak at their events; and the FreeBSD Foundation for sponsoring my trips to BSDCan 2006 and EuroBSDCon 2006. Much like the first, the second edition was written mainly at night and on weekends, as well as during other stolen moments at odd hours. I would like to thank my former colleagues at FreeCode for easing the load for a while by allowing me some chunks of time to work on the second edition in between other projects during the early months of 2010. I would also like to thank several customers, who have asked that their names not be published, for their interesting and challenging projects, which inspired some of the configurations offered here. You know who you are. The reason this third edition exists is that OpenBSD 5.5 introduced a new traffic shaping system that replaced ALTQ. Fortunately Bill Pollock and his team at No Starch Press agreed that this new functionality combined with several other improvements since the second edition were adequate reason to start work on the third edition during the second half of 2013. Finally, during the process of turning the manuscript into a book, sev- eral people did amazing things that helped this book become a lot better. I am indebted to Bill Pollock and Adam Wright for excellent developmental editing; I would like to thank Henning Brauer for excellent technical review; heartfelt thanks go to Eystein Roll Aarseth, Jakob Breivik Grimstveit, Hallvor Engen, Christer Solskogen, Ian Darwin, Jeff Martin, and Lars Noodén for valuable input on various parts of the manuscript; and, finally, warm thanks to Megan Dunchak and Linda Recktenwald for their efforts in getting the first edition of the book into its final shape and to Serena Yang for guiding the second and third editions to completion. Special thanks are due to Dru Lavigne for making the introductions which led to this book getting written in the first place, instead of just hanging around as an online tutorial and occasional conference material. Last but not least, I would like to thank my dear wife, Birthe, and my daughter, Nora, for all their love and support, before and during the book writing process as well as throughout the rather intense work periods that yielded the second and edition. This would not have been possible with- out you. www.it-ebooks.info

i n T r o d u C T i o n This is a book about building the network you need. We’ll dip into the topics of fire- walls and related functions, starting from a little theory. You’ll see plenty of examples of filtering and other ways to direct network traf- fic. I’ll assume that you have a basic to intermediate command of TCP/IP networking concepts and Unix administration. All the information in this book comes with a warning: As in many endeavors, the solutions we discuss can be done in more than one way. And, of course, the software world is always changing and the best way to do things may have changed since this book was printed. This book was tested with OpenBSD version 5.6, FreeBSD 10.0, and NetBSD 6.1, and any patches available in late July 2014. www.it-ebooks.info