The Book of PF, 2nd Edition: A No-Nonsense Guide to the OpenBSD Firewall

Copyright......Page 6
Foreword......Page 15
Acknowledgments......Page 17
Introduction......Page 19
What This Book Covers......Page 20
Your Network: High Performance, Low Maintenance, and Secure......Page 23
The Rise of PF......Page 25
If You Came from Elsewhere......Page 27
Pointers for Linux Users......Page 28
Frequently Answered Questions About PF......Page 29
A Little Encouragement: A PF Haiku......Page 31
2: PF Configuration Basics\r......Page 33
Setting Up PF on OpenBSD......Page 34
Setting Up PF on FreeBSD......Page 35
Setting Up PF on NetBSD......Page 37
A Minimal Rule Set......Page 38
Slightly Stricter: Using Lists and Macros for Readability......Page 40
A Stricter Baseline Rule Set......Page 41
Reloading the Rule Set and Looking for Errors......Page 42
Testing the Changed Rule Set......Page 43
Displaying Information About Your System......Page 44
Looking Ahead......Page 45
3: Into the Real World\r......Page 47
Keep It Simple: Avoid the Pitfalls of in, out, and on......Page 48
Network Address Translation vs. IPv6......Page 49
Final Preparations: Defining Your Local Network......Page 50
Setting Up a Gateway......Page 51
Testing Your Rule Set......Page 55
If We Must: ftp-proxy with Redirection......Page 56
Making Your Network Troubleshooting Friendly......Page 58
Letting ping Through......Page 59
Path MTU Discovery......Page 60
Tables Make Your Life Easier......Page 61
4: Wireless Networks Made Easy......Page 63
MAC Address Filtering......Page 64
WPA......Page 65
Setting Up a Simple Wireless Network......Page 66
An OpenBSD WPA Access Point......Page 69
A FreeBSD WPA Access Point......Page 70
The Access Point’s PF Rule Set......Page 71
Handling IPSec, VPN Solutions......Page 72
The Client Side......Page 73
Guarding Your Wireless Network with authpf......Page 76
A Basic Authenticating Gateway......Page 77
Wide Open but Actually Shut......Page 79
5: Bigger or Trickier Networks\r......Page 81
A Web Server and Mail Server on the Inside- Routable Addresses......Page 82
A Degree of Separation: Introducing the DMZ......Page 85
Sharing the Load: Redirecting to a Pool of Addresses......Page 87
Getting Load Balancing Right with relayd......Page 88
A Web Server and Mail Server on the Inside-the NAT Version......Page 93
Redirection for Load Balancing......Page 95
Back to the Single NATed Network......Page 96
Filtering on Interface Groups......Page 98
The Power of Tags......Page 99
The Bridging Firewall......Page 100
Basic Bridge Setup on OpenBSD......Page 101
Basic Bridge Setup on FreeBSD......Page 102
Basic Bridge Setup on NetBSD......Page 103
The Bridge Rule Set......Page 104
Handling Nonroutable Addresses from Elsewhere......Page 105
6: Turning the Tables for Proactive Defense\r......Page 107
Setting Up an Adaptive Firewall......Page 108
Giving Spammers a Hard Time with spamd......Page 111
Network-Level Behavior Analysis and Blacklisting......Page 112
Greylisting: My Admin Told Me Not to Talk to Strangers......Page 115
Greytrapping......Page 120
Managing Lists with spamdb......Page 122
Handling Sites That Do Not Play Well with Greylisting......Page 124
Spam-Fighting Tips......Page 126
Directing Traffic with ALTQ......Page 127
Queue Schedulers, aka Queue Disciplines......Page 128
Setting Up ALTQ......Page 129
Setting Up Queues......Page 130
Priority-Based Queues......Page 131
Class-Based Bandwidth Allocation for Small Networks......Page 134
A Basic HFSC Traffic Shaper......Page 135
Queueing for Servers in a DMZ......Page 137
Using ALTQ to Handle Unwanted Traffic......Page 139
The Project Specification: A Redundant Pair of Gateways......Page 141
Setting Up CARP......Page 143
Keeping States Synchronized: Adding pfsync......Page 147
Putting Together a Rule Set......Page 148
CARP for Load Balancing......Page 150
8: Logging, Monitoring, and Statistics......Page 153
PF Logs: The Basics......Page 154
Logging All Packets: log (all)......Page 156
Logging to Syslog, Local or Remote......Page 157
Tracking Statistics for Each Rule with Labels......Page 159
Keeping an Eye on Things with systat......Page 161
Graphing Your Traffic with pfstat......Page 163
Collecting NetFlow Data with pflow(4)......Page 165
Collecting NetFlow Data with pfflowd......Page 171
Log Data as the Basis for Effective Debugging......Page 172
Things You Can Tweak and What You Probably Should Leave Alone......Page 173
Skip Interfaces......Page 174
State Defaults......Page 175
Timeouts......Page 176
Limits......Page 177
Debug......Page 178
Rule Set Optimization......Page 179
Packet Normalization with scrub......Page 180
Protecting Against Spoofing with antispoof......Page 181
Testing Your Setup......Page 182
Debugging Your Rule Set......Page 184
Know Your Network and Stay in Control......Page 187
General Networking and BSD Resources on the Internet......Page 189
Sample Configurations and Related Musings......Page 191
BSD and Networking Books......Page 192
spamd and Greylisting-Related Resources......Page 193
Buy OpenBSD CDs and Donate!......Page 194
B: A Note on Hardware Support......Page 195
Getting the Right Hardware......Page 196
How to Help the Hardware Support Efforts......Page 197
Index\r......Page 199