1.\" $OpenBSD: pf.conf.5,v 1.406 2009/01/31 19:37:12 sobrado Exp $ 2.\" 3.\" Copyright (c) 2002, Daniel Hartmeier 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 10.\" - Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" - Redistributions in binary form must reproduce the above 13.\" copyright notice, this list of conditions and the following 14.\" disclaimer in the documentation and/or other materials provided 15.\" with the distribution. 16.\" 17.\" THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 18.\" "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 19.\" LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 20.\" FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 21.\" COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 22.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 23.\" BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 24.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 25.\" CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 27.\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 28.\" POSSIBILITY OF SUCH DAMAGE. 29.\" 30.Dd January 10, 2025 31.Dt PF.CONF 5 32.Os 33.Sh NAME 34.Nm pf.conf 35.Nd packet filter configuration file 36.Sh DESCRIPTION 37The 38.Xr pf 4 39packet filter modifies, drops or passes packets according to rules or 40definitions specified in 41.Nm pf.conf . 42.Sh STATEMENT ORDER 43There are eight types of statements in 44.Nm pf.conf : 45.Bl -tag -width xxxx 46.It Cm Macros 47User-defined variables may be defined and used later, simplifying 48the configuration file. 49Macros must be defined before they are referenced in 50.Nm pf.conf . 51.It Cm Tables 52Tables provide a mechanism for increasing the performance and flexibility of 53rules with large numbers of source or destination addresses. 54.It Cm Options 55Options tune the behaviour of the packet filtering engine. 56.It Cm Ethernet Filtering 57Ethernet filtering provides rule-based blocking or passing of Ethernet packets. 58.It Cm Traffic Normalization Li (e.g. Em scrub ) 59Traffic normalization protects internal machines against inconsistencies 60in Internet protocols and implementations. 61.It Cm Queueing 62Queueing provides rule-based bandwidth control. 63.It Cm Translation Li (Various forms of NAT) 64Translation rules specify how addresses are to be mapped or redirected to 65other addresses. 66.It Cm Packet Filtering 67Packet filtering provides rule-based blocking or passing of packets. 68.El 69.Pp 70With the exception of 71.Cm macros 72and 73.Cm tables , 74the types of statements should be grouped and appear in 75.Nm pf.conf 76in the order shown above, as this matches the operation of the underlying 77packet filtering engine. 78By default 79.Xr pfctl 8 80enforces this order (see 81.Ar set require-order 82below). 83.Pp 84Comments can be put anywhere in the file using a hash mark 85.Pq Sq # , 86and extend to the end of the current line. 87.Pp 88Additional configuration files can be included with the 89.Ic include 90keyword, for example: 91.Bd -literal -offset indent 92include "/etc/pf/sub.filter.conf" 93.Ed 94.Sh MACROS 95Macros can be defined that will later be expanded in context. 96Macro names must start with a letter, and may contain letters, digits 97and underscores. 98Macro names may not be reserved words (for example 99.Ar pass , 100.Ar in , 101.Ar out ) . 102Macros are not expanded inside quotes. 103.Pp 104For example, 105.Bd -literal -offset indent 106ext_if = \&"kue0\&" 107all_ifs = \&"{\&" $ext_if lo0 \&"}\&" 108pass out on $ext_if from any to any 109pass in on $ext_if proto tcp from any to any port 25 110.Ed 111.Sh TABLES 112Tables are named structures which can hold a collection of addresses and 113networks. 114Lookups against tables in 115.Xr pf 4 116are relatively fast, making a single rule with tables much more efficient, 117in terms of 118processor usage and memory consumption, than a large number of rules which 119differ only in IP address (either created explicitly or automatically by rule 120expansion). 121.Pp 122Tables can be used as the source or destination of filter rules, 123.Ar scrub 124rules 125or 126translation rules such as 127.Ar nat 128or 129.Ar rdr 130(see below for details on the various rule types). 131Tables can also be used for the redirect address of 132.Ar nat 133and 134.Ar rdr 135rules and in the routing options of filter rules, but only for 136.Ar round-robin 137pools. 138.Pp 139Tables can be defined with any of the following 140.Xr pfctl 8 141mechanisms. 142As with macros, reserved words may not be used as table names. 143.Bl -tag -width "manually" 144.It Ar manually 145Persistent tables can be manually created with the 146.Ar add 147or 148.Ar replace 149option of 150.Xr pfctl 8 , 151before or after the ruleset has been loaded. 152.It Pa pf.conf 153Table definitions can be placed directly in this file, and loaded at the 154same time as other rules are loaded, atomically. 155Table definitions inside 156.Nm pf.conf 157use the 158.Ar table 159statement, and are especially useful to define non-persistent tables. 160The contents of a pre-existing table defined without a list of addresses 161to initialize it is not altered when 162.Nm pf.conf 163is loaded. 164A table initialized with the empty list, 165.Li { } , 166will be cleared on load. 167.El 168.Pp 169Tables may be defined with the following attributes: 170.Bl -tag -width persist 171.It Ar persist 172The 173.Ar persist 174flag forces the kernel to keep the table even when no rules refer to it. 175If the flag is not set, the kernel will automatically remove the table 176when the last rule referring to it is flushed. 177.It Ar const 178The 179.Ar const 180flag prevents the user from altering the contents of the table once it 181has been created. 182Without that flag, 183.Xr pfctl 8 184can be used to add or remove addresses from the table at any time, even 185when running with 186.Xr securelevel 7 187= 2. 188.It Ar counters 189The 190.Ar counters 191flag enables per-address packet and byte counters which can be displayed with 192.Xr pfctl 8 . 193Note that this feature carries significant memory overhead for large tables. 194.El 195.Pp 196For example, 197.Bd -literal -offset indent 198table \*(Ltprivate\*(Gt const { 10/8, 172.16/12, 192.168/16 } 199table \*(Ltbadhosts\*(Gt persist 200block on fxp0 from { \*(Ltprivate\*(Gt, \*(Ltbadhosts\*(Gt } to any 201.Ed 202.Pp 203creates a table called private, to hold RFC 1918 private network 204blocks, and a table called badhosts, which is initially empty. 205A filter rule is set up to block all traffic coming from addresses listed in 206either table. 207The private table cannot have its contents changed and the badhosts table 208will exist even when no active filter rules reference it. 209Addresses may later be added to the badhosts table, so that traffic from 210these hosts can be blocked by using 211.Bd -literal -offset indent 212# pfctl -t badhosts -Tadd 204.92.77.111 213.Ed 214.Pp 215A table can also be initialized with an address list specified in one or more 216external files, using the following syntax: 217.Bd -literal -offset indent 218table \*(Ltspam\*(Gt persist file \&"/etc/spammers\&" file \&"/etc/openrelays\&" 219block on fxp0 from \*(Ltspam\*(Gt to any 220.Ed 221.Pp 222The files 223.Pa /etc/spammers 224and 225.Pa /etc/openrelays 226list IP addresses, one per line. 227Any lines beginning with a # are treated as comments and ignored. 228In addition to being specified by IP address, hosts may also be 229specified by their hostname. 230When the resolver is called to add a hostname to a table, 231.Em all 232resulting IPv4 and IPv6 addresses are placed into the table. 233IP addresses can also be entered in a table by specifying a valid interface 234name, a valid interface group or the 235.Em self 236keyword, in which case all addresses assigned to the interface(s) will be 237added to the table. 238.Sh OPTIONS 239.Xr pf 4 240may be tuned for various situations using the 241.Ar set 242command. 243.Bl -tag -width xxxx 244.It Ar set timeout 245.Pp 246.Bl -tag -width "src.track" -compact 247.It Ar interval 248Interval between purging expired states and fragments. 249.It Ar frag 250Seconds before an unassembled fragment is expired. 251.It Ar src.track 252Length of time to retain a source tracking entry after the last state 253expires. 254.El 255.Pp 256When a packet matches a stateful connection, the seconds to live for the 257connection will be updated to that of the 258.Ar proto.modifier 259which corresponds to the connection state. 260Each packet which matches this state will reset the TTL. 261Tuning these values may improve the performance of the 262firewall at the risk of dropping valid idle connections. 263.Pp 264.Bl -tag -width xxxx -compact 265.It Ar tcp.first 266The state after the first packet. 267.It Ar tcp.opening 268The state after the second packet but before both endpoints have 269acknowledged the connection. 270.It Ar tcp.established 271The fully established state. 272.It Ar tcp.closing 273The state after the first FIN has been sent. 274.It Ar tcp.finwait 275The state after both FINs have been exchanged and the connection is closed. 276Some hosts (notably web servers on Solaris) send TCP packets even after closing 277the connection. 278Increasing 279.Ar tcp.finwait 280(and possibly 281.Ar tcp.closing ) 282can prevent blocking of such packets. 283.It Ar tcp.closed 284The state after one endpoint sends an RST. 285.El 286.Pp 287SCTP timeout are handled similar to TCP, but with its own set of states: 288.Pp 289.Bl -tag -width xxxx -compact 290.It Ar sctp.first 291The state after the first packet. 292.It Ar sctp.opening 293The state before the destination host ever sends a packet. 294.It Ar sctp.established 295The fully established state. 296.It Ar sctp.closing 297The state after the first SHUTDOWN chunk has been sent. 298.It Ar sctp.closed 299The state after SHUTDOWN_ACK has been exchanged and the connection is closed. 300.El 301.Pp 302ICMP and UDP are handled in a fashion similar to TCP, but with a much more 303limited set of states: 304.Pp 305.Bl -tag -width xxxx -compact 306.It Ar udp.first 307The state after the first packet. 308.It Ar udp.single 309The state if the source host sends more than one packet but the destination 310host has never sent one back. 311.It Ar udp.multiple 312The state if both hosts have sent packets. 313.It Ar icmp.first 314The state after the first packet. 315.It Ar icmp.error 316The state after an ICMP error came back in response to an ICMP packet. 317.El 318.Pp 319Other protocols are handled similarly to UDP: 320.Pp 321.Bl -tag -width xxxx -compact 322.It Ar other.first 323.It Ar other.single 324.It Ar other.multiple 325.El 326.Pp 327Timeout values can be reduced adaptively as the number of state table 328entries grows. 329.Pp 330.Bl -tag -width xxxx -compact 331.It Ar adaptive.start 332When the number of state entries exceeds this value, adaptive scaling 333begins. 334All timeout values are scaled linearly with factor 335(adaptive.end - number of states) / (adaptive.end - adaptive.start). 336.It Ar adaptive.end 337When reaching this number of state entries, all timeout values become 338zero, effectively purging all state entries immediately. 339This value is used to define the scale factor, it should not actually 340be reached (set a lower state limit, see below). 341.El 342.Pp 343Adaptive timeouts are enabled by default, with an adaptive.start value 344equal to 60% of the state limit, and an adaptive.end value equal to 345120% of the state limit. 346They can be disabled by setting both adaptive.start and adaptive.end to 0. 347.Pp 348The adaptive timeout values can be defined both globally and for each rule. 349When used on a per-rule basis, the values relate to the number of 350states created by the rule, otherwise to the total number of 351states. 352.Pp 353For example: 354.Bd -literal -offset indent 355set timeout tcp.first 120 356set timeout tcp.established 86400 357set timeout { adaptive.start 6000, adaptive.end 12000 } 358set limit states 10000 359.Ed 360.Pp 361With 9000 state table entries, the timeout values are scaled to 50% 362(tcp.first 60, tcp.established 43200). 363.It Ar set loginterface 364Enable collection of packet and byte count statistics for the given 365interface or interface group. 366These statistics can be viewed using 367.Bd -literal -offset indent 368# pfctl -s info 369.Ed 370.Pp 371In this example 372.Xr pf 4 373collects statistics on the interface named dc0: 374.Bd -literal -offset indent 375set loginterface dc0 376.Ed 377.Pp 378One can disable the loginterface using: 379.Bd -literal -offset indent 380set loginterface none 381.Ed 382.It Ar set limit 383Sets hard limits on the memory pools used by the packet filter. 384See 385.Xr zone 9 386for an explanation of memory pools. 387.Pp 388For example, 389.Bd -literal -offset indent 390set limit states 20000 391.Ed 392.Pp 393sets the maximum number of entries in the memory pool used by state table 394entries (generated by 395.Ar pass 396rules which do not specify 397.Ar no state ) 398to 20000. 399Using 400.Bd -literal -offset indent 401set limit frags 20000 402.Ed 403.Pp 404sets the maximum number of entries in the memory pool used for fragment 405reassembly (generated by the 406.Ar set reassemble 407option or 408.Ar scrub 409rules) to 20000. 410Using 411.Bd -literal -offset indent 412set limit src-nodes 2000 413.Ed 414.Pp 415sets the maximum number of entries in the memory pool used for tracking 416source IP addresses (generated by the 417.Ar sticky-address 418and 419.Ar src.track 420options) to 2000. 421Using 422.Bd -literal -offset indent 423set limit table-entries 100000 424.Ed 425.Pp 426sets the limit on the overall number of addresses that can be stored 427in tables to 100000. 428.Pp 429Various limits can be combined on a single line: 430.Bd -literal -offset indent 431set limit { states 20000, frags 20000, src-nodes 2000 } 432.Ed 433.It Ar set ruleset-optimization 434.Bl -tag -width xxxxxxxx -compact 435.It Ar none 436Disable the ruleset optimizer. 437.It Ar basic 438Enable basic ruleset optimization. 439This is the default behaviour. 440Basic ruleset optimization does four things to improve the 441performance of ruleset evaluations: 442.Pp 443.Bl -enum -compact 444.It 445remove duplicate rules 446.It 447remove rules that are a subset of another rule 448.It 449combine multiple rules into a table when advantageous 450.It 451re-order the rules to improve evaluation performance 452.El 453.Pp 454.It Ar profile 455Uses the currently loaded ruleset as a feedback profile to tailor the 456ordering of quick rules to actual network traffic. 457.El 458.Pp 459It is important to note that the ruleset optimizer will modify the ruleset 460to improve performance. 461A side effect of the ruleset modification is that per-rule accounting 462statistics will have different meanings than before. 463If per-rule accounting is important for billing purposes or whatnot, 464either the ruleset optimizer should not be used or a label field should 465be added to all of the accounting rules to act as optimization barriers. 466.Pp 467Optimization can also be set as a command-line argument to 468.Xr pfctl 8 , 469overriding the settings in 470.Nm . 471.It Ar set optimization 472Optimize state timeouts for one of the following network environments: 473.Pp 474.Bl -tag -width xxxx -compact 475.It Ar normal 476A normal network environment. 477Suitable for almost all networks. 478.It Ar high-latency 479A high-latency environment (such as a satellite connection). 480.It Ar satellite 481Alias for 482.Ar high-latency . 483.It Ar aggressive 484Aggressively expire connections. 485This can greatly reduce the memory usage of the firewall at the cost of 486dropping idle connections early. 487.It Ar conservative 488Extremely conservative settings. 489Avoid dropping legitimate connections at the 490expense of greater memory utilization (possibly much greater on a busy 491network) and slightly increased processor utilization. 492.El 493.Pp 494For example: 495.Bd -literal -offset indent 496set optimization aggressive 497.Ed 498.It Ar set reassemble yes | no Op Cm no-df 499The 500.Cm reassemble 501option is used to enable or disable the reassembly of fragmented packets, 502and can be set to 503.Cm yes 504or 505.Cm no . 506If 507.Cm no-df 508is also specified, fragments with the 509.Dq dont-fragment 510bit set are reassembled too, 511instead of being dropped; 512the reassembled packet will have the 513.Dq dont-fragment 514bit cleared. 515The default value is 516.Cm no . 517.Pp 518This option is ignored if there are pre-FreeBSD 14 519.Cm scrub 520rules present. 521.It Ar set block-policy 522The 523.Ar block-policy 524option sets the default behaviour for the packet 525.Ar block 526action: 527.Pp 528.Bl -tag -width xxxxxxxx -compact 529.It Ar drop 530Packet is silently dropped. 531.It Ar return 532A TCP RST is returned for blocked TCP packets, 533an SCTP ABORT chunk is returned for blocked SCTP packets, 534an ICMP UNREACHABLE is returned for blocked UDP packets, 535and all other packets are silently dropped. 536.El 537.Pp 538For example: 539.Bd -literal -offset indent 540set block-policy return 541.Ed 542.It Ar set fail-policy 543The 544.Ar fail-policy 545option sets the behaviour of rules which should pass a packet but were 546unable to do so. 547This might happen when a nat or route-to rule uses an empty table as list 548of targets or if a rule fails to create state or source node. 549The following 550.Ar block 551actions are possible: 552.Pp 553.Bl -tag -width xxxxxxxx -compact 554.It Ar drop 555Incoming packet is silently dropped. 556.It Ar return 557Incoming packet is dropped and TCP RST is returned for TCP packets, 558an SCTP ABORT chunk is returned for blocked SCTP packets, 559an ICMP UNREACHABLE is returned for UDP packets, 560and no response is sent for other packets. 561.El 562.Pp 563For example: 564.Bd -literal -offset indent 565set fail-policy return 566.Ed 567.It Ar set state-policy 568The 569.Ar state-policy 570option sets the default behaviour for states: 571.Pp 572.Bl -tag -width group-bound -compact 573.It Ar if-bound 574States are bound to interface. 575.It Ar floating 576States can match packets on any interfaces (the default). 577.El 578.Pp 579For example: 580.Bd -literal -offset indent 581set state-policy if-bound 582.Ed 583.It Ar set syncookies never | always | adaptive 584When 585.Cm syncookies 586are active, pf will answer each incoming TCP SYN with a syncookie SYNACK, 587without allocating any resources. 588Upon reception of the client's ACK in response to the syncookie 589SYNACK, pf will evaluate the ruleset and create state if the ruleset 590permits it, complete the three way handshake with the target host and 591continue the connection with synproxy in place. 592This allows pf to be resilient against large synflood attacks which would 593run the state table against its limits otherwise. 594Due to the blind answers to every incoming SYN syncookies share the caveats of 595synproxy, namely seemingly accepting connections that will be dropped later on. 596.Pp 597.Bl -tag -width adaptive -compact 598.It Cm never 599pf will never send syncookie SYNACKs (the default). 600.It Cm always 601pf will always send syncookie SYNACKs. 602.It Cm adaptive 603pf will enable syncookie mode when a given percentage of the state table 604is used up by half-open TCP connections, as in, those that saw the initial 605SYN but didn't finish the three way handshake. 606The thresholds for entering and leaving syncookie mode can be specified using 607.Bd -literal -offset indent 608set syncookies adaptive (start 25%, end 12%) 609.Ed 610.El 611.It Ar set state-defaults 612The 613.Ar state-defaults 614option sets the state options for states created from rules 615without an explicit 616.Ar keep state . 617For example: 618.Bd -literal -offset indent 619set state-defaults no-sync 620.Ed 621.It Ar set hostid 622The 32-bit 623.Ar hostid 624identifies this firewall's state table entries to other firewalls 625in a 626.Xr pfsync 4 627failover cluster. 628By default the hostid is set to a pseudo-random value, however it may be 629desirable to manually configure it, for example to more easily identify the 630source of state table entries. 631.Bd -literal -offset indent 632set hostid 1 633.Ed 634.Pp 635The hostid may be specified in either decimal or hexadecimal. 636.It Ar set require-order 637By default 638.Xr pfctl 8 639enforces an ordering of the statement types in the ruleset to: 640.Em options , 641.Em normalization , 642.Em queueing , 643.Em translation , 644.Em filtering . 645Setting this option to 646.Ar no 647disables this enforcement. 648There may be non-trivial and non-obvious implications to an out of 649order ruleset. 650Consider carefully before disabling the order enforcement. 651.It Ar set fingerprints 652Load fingerprints of known operating systems from the given filename. 653By default fingerprints of known operating systems are automatically 654loaded from 655.Xr pf.os 5 656in 657.Pa /etc 658but can be overridden via this option. 659Setting this option may leave a small period of time where the fingerprints 660referenced by the currently active ruleset are inconsistent until the new 661ruleset finishes loading. 662.Pp 663For example: 664.Pp 665.Dl set fingerprints \&"/etc/pf.os.devel\&" 666.It Ar set skip on Aq Ar ifspec 667List interfaces for which packets should not be filtered. 668Packets passing in or out on such interfaces are passed as if pf was 669disabled, i.e. pf does not process them in any way. 670This can be useful on loopback and other virtual interfaces, when 671packet filtering is not desired and can have unexpected effects. 672For example: 673.Pp 674.Dl set skip on lo0 675.It Ar set debug 676Set the debug 677.Ar level 678to one of the following: 679.Pp 680.Bl -tag -width xxxxxxxxxxxx -compact 681.It Ar none 682Don't generate debug messages. 683.It Ar urgent 684Generate debug messages only for serious errors. 685.It Ar misc 686Generate debug messages for various errors. 687.It Ar loud 688Generate debug messages for common conditions. 689.El 690.It Ar set keepcounters 691Preserve rule counters across rule updates. 692Usually rule counters are reset to zero on every update of the ruleset. 693With 694.Ar keepcounters 695set pf will attempt to find matching rules between old and new rulesets 696and preserve the rule counters. 697.El 698.Sh ETHERNET FILTERING 699.Xr pf 4 700has the ability to 701.Ar block 702and 703.Ar pass 704packets based on attributes of their Ethernet (layer 2) header. 705.Pp 706For each packet processed by the packet filter, the filter rules are 707evaluated in sequential order, from first to last. 708The last matching rule decides what action is taken. 709If no rule matches the packet, the default action is to pass 710the packet. 711.Pp 712The following actions can be used in the filter: 713.Bl -tag -width xxxx 714.It Ar block 715The packet is blocked. 716Unlike for layer 3 traffic the packet is always silently dropped. 717.It Ar pass 718The packet is passed; 719no state is created for layer 2 traffic. 720.El 721.Sh PARAMETERS 722The rule parameters specify the packets to which a rule applies. 723A packet always comes in on, or goes out through, one interface. 724Most parameters are optional. 725If a parameter is specified, the rule only applies to packets with 726matching attributes. 727Certain parameters can be expressed as lists, in which case 728.Xr pfctl 8 729generates all needed rule combinations. 730.Bl -tag -width xxxx 731.It Ar in No or Ar out 732This rule applies to incoming or outgoing packets. 733If neither 734.Ar in 735nor 736.Ar out 737are specified, the rule will match packets in both directions. 738.It Ar quick 739If a packet matches a rule which has the 740.Ar quick 741option set, this rule 742is considered the last matching rule, and evaluation of subsequent rules 743is skipped. 744.It Ar on Aq Ar ifspec 745This rule applies only to packets coming in on, or going out through, this 746particular interface or interface group. 747For more information on interface groups, 748see the 749.Ic group 750keyword in 751.Xr ifconfig 8 . 752.It Ar bridge-to Aq interface 753Packets matching this rule will be sent out of the specified interface without 754further processing. 755.It Ar proto Aq Ar protocol 756This rule applies only to packets of this protocol. 757Note that Ethernet protocol numbers are different from those used in 758.Xr ip 4 759and 760.Xr ip6 4 . 761.It Xo 762.Ar from Aq Ar source 763.Ar to Aq Ar dest 764.Xc 765This rule applies only to packets with the specified source and destination 766MAC addresses. 767.It Xo Ar queue Aq Ar queue 768.Xc 769Packets matching this rule will be assigned to the specified queue. 770See 771.Sx QUEUEING 772for setup details. 773.Pp 774.It Ar tag Aq Ar string 775Packets matching this rule will be tagged with the 776specified string. 777The tag acts as an internal marker that can be used to 778identify these packets later on. 779This can be used, for example, to provide trust between 780interfaces and to determine if packets have been 781processed by translation rules. 782Tags are 783.Qq sticky , 784meaning that the packet will be tagged even if the rule 785is not the last matching rule. 786Further matching rules can replace the tag with a 787new one but will not remove a previously applied tag. 788A packet is only ever assigned one tag at a time. 789.It Ar tagged Aq Ar string 790Used to specify that packets must already be tagged with the given tag in order 791to match the rule. 792Inverse tag matching can also be done by specifying the ! operator before the 793tagged keyword. 794.El 795.Sh TRAFFIC NORMALIZATION 796Traffic normalization is a broad umbrella term 797for aspects of the packet filter which deal with 798verifying packets, packet fragments, spoofed traffic, 799and other irregularities. 800.Ss Scrub 801Scrub involves sanitising packet content in such a way 802that there are no ambiguities in packet interpretation on the receiving side. 803It is invoked with the 804.Cm scrub 805option, added to filter rules. 806.Pp 807Parameters are specified enclosed in parentheses. 808At least one of the following parameters must be specified: 809.Bl -tag -width xxxx 810.It Ar no-df 811Clears the 812.Ar dont-fragment 813bit from a matching IP packet. 814Some operating systems are known to generate fragmented packets with the 815.Ar dont-fragment 816bit set. 817This is particularly true with NFS. 818.Ar Scrub 819will drop such fragmented 820.Ar dont-fragment 821packets unless 822.Ar no-df 823is specified. 824.Pp 825Unfortunately some operating systems also generate their 826.Ar dont-fragment 827packets with a zero IP identification field. 828Clearing the 829.Ar dont-fragment 830bit on packets with a zero IP ID may cause deleterious results if an 831upstream router later fragments the packet. 832Using the 833.Ar random-id 834modifier (see below) is recommended in combination with the 835.Ar no-df 836modifier to ensure unique IP identifiers. 837.It Ar min-ttl Aq Ar number 838Enforces a minimum TTL for matching IP packets. 839.It Ar max-mss Aq Ar number 840Enforces a maximum MSS for matching TCP packets. 841.It Xo Ar set-tos Aq Ar string 842.No \*(Ba Aq Ar number 843.Xc 844Enforces a 845.Em TOS 846for matching IP packets. 847.Em TOS 848may be 849given as one of 850.Ar critical , 851.Ar inetcontrol , 852.Ar lowdelay , 853.Ar netcontrol , 854.Ar throughput , 855.Ar reliability , 856or one of the DiffServ Code Points: 857.Ar ef , 858.Ar va , 859.Ar af11 No ... Ar af43 , 860.Ar cs0 No ... Ar cs7 ; 861or as either hex or decimal. 862.It Ar random-id 863Replaces the IP identification field with random values to compensate 864for predictable values generated by many hosts. 865This option only applies to packets that are not fragmented 866after the optional fragment reassembly. 867.It Ar reassemble tcp 868Statefully normalizes TCP connections. 869.Ar reassemble tcp 870performs the following normalizations: 871.Pp 872.Bl -tag -width timeout -compact 873.It ttl 874Neither side of the connection is allowed to reduce their IP TTL. 875An attacker may send a packet such that it reaches the firewall, affects 876the firewall state, and expires before reaching the destination host. 877.Ar reassemble tcp 878will raise the TTL of all packets back up to the highest value seen on 879the connection. 880.It timestamp modulation 881Modern TCP stacks will send a timestamp on every TCP packet and echo 882the other endpoint's timestamp back to them. 883Many operating systems will merely start the timestamp at zero when 884first booted, and increment it several times a second. 885The uptime of the host can be deduced by reading the timestamp and multiplying 886by a constant. 887Also observing several different timestamps can be used to count hosts 888behind a NAT device. 889And spoofing TCP packets into a connection requires knowing or guessing 890valid timestamps. 891Timestamps merely need to be monotonically increasing and not derived off a 892guessable base time. 893.Ar reassemble tcp 894will cause 895.Ar scrub 896to modulate the TCP timestamps with a random number. 897.It extended PAWS checks 898There is a problem with TCP on long fat pipes, in that a packet might get 899delayed for longer than it takes the connection to wrap its 32-bit sequence 900space. 901In such an occurrence, the old packet would be indistinguishable from a 902new packet and would be accepted as such. 903The solution to this is called PAWS: Protection Against Wrapped Sequence 904numbers. 905It protects against it by making sure the timestamp on each packet does 906not go backwards. 907.Ar reassemble tcp 908also makes sure the timestamp on the packet does not go forward more 909than the RFC allows. 910By doing this, 911.Xr pf 4 912artificially extends the security of TCP sequence numbers by 10 to 18 913bits when the host uses appropriately randomized timestamps, since a 914blind attacker would have to guess the timestamp as well. 915.El 916.El 917.Pp 918For example, 919.Bd -literal -offset indent 920match in all scrub (no-df random-id max-mss 1440) 921.Ed 922.Ss Scrub ruleset (pre-FreeBSD 14) 923In order to maintain compatibility with older releases of FreeBSD 924.Ar scrub 925rules can also be specified in their own ruleset. 926In such case they are invoked with the 927.Ar scrub 928directive. 929If there are such rules present they determine packet reassembly behaviour. 930When no such rules are present the option 931.Ar set reassembly 932takes precedence. 933The 934.Ar scrub 935rules can take all parameters specified above for a 936.Ar scrub 937option of filter rules and 2 more parameters controlling fragment reassembly: 938.Bl -tag -width xxxx 939.It Ar fragment reassemble 940Using 941.Ar scrub 942rules, fragments can be reassembled by normalization. 943In this case, fragments are buffered until they form a complete 944packet, and only the completed packet is passed on to the filter. 945The advantage is that filter rules have to deal only with complete 946packets, and can ignore fragments. 947The drawback of caching fragments is the additional memory cost. 948This is the default behaviour unless no fragment reassemble is specified. 949.It Ar no fragment reassemble 950Do not reassemble fragments. 951.El 952.Pp 953For example, 954.Bd -literal -offset indent 955scrub in on $ext_if all fragment reassemble 956.Ed 957.Pp 958The 959.Ar no 960option prefixed to a scrub rule causes matching packets to remain unscrubbed, 961much in the same way as 962.Ar drop quick 963works in the packet filter (see below). 964This mechanism should be used when it is necessary to exclude specific packets 965from broader scrub rules. 966.Pp 967.Ar scrub 968rules in the 969.Ar scrub 970ruleset are evaluated for every packet before stateful filtering. 971This means excessive usage of them will cause performance penalty. 972.Ar scrub reassemble tcp 973rules must not have the direction (in/out) specified. 974.Sh QUEUEING with ALTQ 975The ALTQ system is currently not available in the GENERIC kernel nor as 976loadable modules. 977In order to use the herein after called queueing options one has to use a 978custom built kernel. 979Please refer to 980.Xr altq 4 981to learn about the related kernel options. 982.Pp 983Packets can be assigned to queues for the purpose of bandwidth 984control. 985At least two declarations are required to configure queues, and later 986any packet filtering rule can reference the defined queues by name. 987During the filtering component of 988.Nm pf.conf , 989the last referenced 990.Ar queue 991name is where any packets from 992.Ar pass 993rules will be queued, while for 994.Ar block 995rules it specifies where any resulting ICMP or TCP RST 996packets should be queued. 997The 998.Ar scheduler 999defines the algorithm used to decide which packets get delayed, dropped, or 1000sent out immediately. 1001There are three 1002.Ar schedulers 1003currently supported. 1004.Bl -tag -width xxxx 1005.It Ar cbq 1006Class Based Queueing. 1007.Ar Queues 1008attached to an interface build a tree, thus each 1009.Ar queue 1010can have further child 1011.Ar queues . 1012Each queue can have a 1013.Ar priority 1014and a 1015.Ar bandwidth 1016assigned. 1017.Ar Priority 1018mainly controls the time packets take to get sent out, while 1019.Ar bandwidth 1020has primarily effects on throughput. 1021.Ar cbq 1022achieves both partitioning and sharing of link bandwidth 1023by hierarchically structured classes. 1024Each class has its own 1025.Ar queue 1026and is assigned its share of 1027.Ar bandwidth . 1028A child class can borrow bandwidth from its parent class 1029as long as excess bandwidth is available 1030(see the option 1031.Ar borrow , 1032below). 1033.It Ar priq 1034Priority Queueing. 1035.Ar Queues 1036are flat attached to the interface, thus, 1037.Ar queues 1038cannot have further child 1039.Ar queues . 1040Each 1041.Ar queue 1042has a unique 1043.Ar priority 1044assigned, ranging from 0 to 15. 1045Packets in the 1046.Ar queue 1047with the highest 1048.Ar priority 1049are processed first. 1050.It Ar hfsc 1051Hierarchical Fair Service Curve. 1052.Ar Queues 1053attached to an interface build a tree, thus each 1054.Ar queue 1055can have further child 1056.Ar queues . 1057Each queue can have a 1058.Ar priority 1059and a 1060.Ar bandwidth 1061assigned. 1062.Ar Priority 1063mainly controls the time packets take to get sent out, while 1064.Ar bandwidth 1065primarily affects throughput. 1066.Ar hfsc 1067supports both link-sharing and guaranteed real-time services. 1068It employs a service curve based QoS model, 1069and its unique feature is an ability to decouple 1070.Ar delay 1071and 1072.Ar bandwidth 1073allocation. 1074.El 1075.Pp 1076The interfaces on which queueing should be activated are declared using 1077the 1078.Ar altq on 1079declaration. 1080.Ar altq on 1081has the following keywords: 1082.Bl -tag -width xxxx 1083.It Aq Ar interface 1084Queueing is enabled on the named interface. 1085.It Aq Ar scheduler 1086Specifies which queueing scheduler to use. 1087Currently supported values 1088are 1089.Ar cbq 1090for Class Based Queueing, 1091.Ar priq 1092for Priority Queueing and 1093.Ar hfsc 1094for the Hierarchical Fair Service Curve scheduler. 1095.It Ar bandwidth Aq Ar bw 1096The maximum bitrate for all queues on an 1097interface may be specified using the 1098.Ar bandwidth 1099keyword. 1100The value can be specified as an absolute value or as a 1101percentage of the interface bandwidth. 1102When using an absolute value, the suffixes 1103.Ar b , 1104.Ar Kb , 1105.Ar Mb , 1106and 1107.Ar Gb 1108are used to represent bits, kilobits, megabits, and 1109gigabits per second, respectively. 1110The value must not exceed the interface bandwidth. 1111If 1112.Ar bandwidth 1113is not specified, the interface bandwidth is used 1114(but take note that some interfaces do not know their bandwidth, 1115or can adapt their bandwidth rates). 1116.It Ar qlimit Aq Ar limit 1117The maximum number of packets held in the queue. 1118The default is 50. 1119.It Ar tbrsize Aq Ar size 1120Adjusts the size, in bytes, of the token bucket regulator. 1121If not specified, heuristics based on the 1122interface bandwidth are used to determine the size. 1123.It Ar queue Aq Ar list 1124Defines a list of subqueues to create on an interface. 1125.El 1126.Pp 1127In the following example, the interface dc0 1128should queue up to 5Mbps in four second-level queues using 1129Class Based Queueing. 1130Those four queues will be shown in a later example. 1131.Bd -literal -offset indent 1132altq on dc0 cbq bandwidth 5Mb queue { std, http, mail, ssh } 1133.Ed 1134.Pp 1135Once interfaces are activated for queueing using the 1136.Ar altq 1137directive, a sequence of 1138.Ar queue 1139directives may be defined. 1140The name associated with a 1141.Ar queue 1142must match a queue defined in the 1143.Ar altq 1144directive (e.g. mail), or, except for the 1145.Ar priq 1146.Ar scheduler , 1147in a parent 1148.Ar queue 1149declaration. 1150The following keywords can be used: 1151.Bl -tag -width xxxx 1152.It Ar on Aq Ar interface 1153Specifies the interface the queue operates on. 1154If not given, it operates on all matching interfaces. 1155.It Ar bandwidth Aq Ar bw 1156Specifies the maximum bitrate to be processed by the queue. 1157This value must not exceed the value of the parent 1158.Ar queue 1159and can be specified as an absolute value or a percentage of the parent 1160queue's bandwidth. 1161If not specified, defaults to 100% of the parent queue's bandwidth. 1162The 1163.Ar priq 1164scheduler does not support bandwidth specification. 1165.It Ar priority Aq Ar level 1166Between queues a priority level can be set. 1167For 1168.Ar cbq 1169and 1170.Ar hfsc , 1171the range is 0 to 7 and for 1172.Ar priq , 1173the range is 0 to 15. 1174The default for all is 1. 1175.Ar Priq 1176queues with a higher priority are always served first. 1177.Ar Cbq 1178and 1179.Ar Hfsc 1180queues with a higher priority are preferred in the case of overload. 1181.It Ar qlimit Aq Ar limit 1182The maximum number of packets held in the queue. 1183The default is 50. 1184.El 1185.Pp 1186The 1187.Ar scheduler 1188can get additional parameters with 1189.Xo Aq Ar scheduler 1190.Pf ( Aq Ar parameters ) . 1191.Xc 1192Parameters are as follows: 1193.Bl -tag -width Fl 1194.It Ar default 1195Packets not matched by another queue are assigned to this one. 1196Exactly one default queue is required. 1197.It Ar red 1198Enable RED (Random Early Detection) on this queue. 1199RED drops packets with a probability proportional to the average 1200queue length. 1201.It Ar rio 1202Enables RIO on this queue. 1203RIO is RED with IN/OUT, thus running 1204RED two times more than RIO would achieve the same effect. 1205RIO is currently not supported in the GENERIC kernel. 1206.It Ar ecn 1207Enables ECN (Explicit Congestion Notification) on this queue. 1208ECN implies RED. 1209.El 1210.Pp 1211The 1212.Ar cbq 1213.Ar scheduler 1214supports an additional option: 1215.Bl -tag -width Fl 1216.It Ar borrow 1217The queue can borrow bandwidth from the parent. 1218.El 1219.Pp 1220The 1221.Ar hfsc 1222.Ar scheduler 1223supports some additional options: 1224.Bl -tag -width Fl 1225.It Ar realtime Aq Ar sc 1226The minimum required bandwidth for the queue. 1227.It Ar upperlimit Aq Ar sc 1228The maximum allowed bandwidth for the queue. 1229.It Ar linkshare Aq Ar sc 1230The bandwidth share of a backlogged queue. 1231.El 1232.Pp 1233.Aq Ar sc 1234is an acronym for 1235.Ar service curve . 1236.Pp 1237The format for service curve specifications is 1238.Ar ( m1 , d , m2 ) . 1239.Ar m2 1240controls the bandwidth assigned to the queue. 1241.Ar m1 1242and 1243.Ar d 1244are optional and can be used to control the initial bandwidth assignment. 1245For the first 1246.Ar d 1247milliseconds the queue gets the bandwidth given as 1248.Ar m1 , 1249afterwards the value given in 1250.Ar m2 . 1251.Pp 1252Furthermore, with 1253.Ar cbq 1254and 1255.Ar hfsc , 1256child queues can be specified as in an 1257.Ar altq 1258declaration, thus building a tree of queues using a part of 1259their parent's bandwidth. 1260.Pp 1261Packets can be assigned to queues based on filter rules by using the 1262.Ar queue 1263keyword. 1264Normally only one 1265.Ar queue 1266is specified; when a second one is specified it will instead be used for 1267packets which have a 1268.Em TOS 1269of 1270.Em lowdelay 1271and for TCP ACKs with no data payload. 1272.Pp 1273To continue the previous example, the examples below would specify the 1274four referenced 1275queues, plus a few child queues. 1276Interactive 1277.Xr ssh 1 1278sessions get priority over bulk transfers like 1279.Xr scp 1 1280and 1281.Xr sftp 1 . 1282The queues may then be referenced by filtering rules (see 1283.Sx PACKET FILTERING 1284below). 1285.Bd -literal 1286queue std bandwidth 10% cbq(default) 1287queue http bandwidth 60% priority 2 cbq(borrow red) \e 1288 { employees, developers } 1289queue developers bandwidth 75% cbq(borrow) 1290queue employees bandwidth 15% 1291queue mail bandwidth 10% priority 0 cbq(borrow ecn) 1292queue ssh bandwidth 20% cbq(borrow) { ssh_interactive, ssh_bulk } 1293queue ssh_interactive bandwidth 50% priority 7 cbq(borrow) 1294queue ssh_bulk bandwidth 50% priority 0 cbq(borrow) 1295 1296block return out on dc0 inet all queue std 1297pass out on dc0 inet proto tcp from $developerhosts to any port 80 \e 1298 queue developers 1299pass out on dc0 inet proto tcp from $employeehosts to any port 80 \e 1300 queue employees 1301pass out on dc0 inet proto tcp from any to any port 22 \e 1302 queue(ssh_bulk, ssh_interactive) 1303pass out on dc0 inet proto tcp from any to any port 25 \e 1304 queue mail 1305.Ed 1306.Sh QUEUEING with dummynet 1307Queueing can also be done with 1308.Xr dummynet 4 . 1309Queues and pipes can be created with 1310.Xr dnctl 8 . 1311.Pp 1312Packets can be assigned to queues and pipes using 1313.Ar dnqueue 1314and 1315.Ar dnpipe 1316respectively. 1317.Pp 1318Both 1319.Ar dnqueue 1320and 1321.Ar dnpipe 1322take either a single pipe or queue number or two numbers as arguments. 1323The first pipe or queue number will be used to shape the traffic in the rule 1324direction, the second will be used to shape the traffic in the reverse 1325direction. 1326If the rule does not specify a direction the first packet to create state will 1327be shaped according to the first number, and the response traffic according to 1328the second. 1329.Pp 1330If the 1331.Xr dummynet 4 1332module is not loaded any traffic sent into a queue or pipe will be dropped. 1333.Sh TRANSLATION 1334Translation rules modify either the source or destination address of the 1335packets associated with a stateful connection. 1336A stateful connection is automatically created to track packets matching 1337such a rule as long as they are not blocked by the filtering section of 1338.Nm pf.conf . 1339The translation engine modifies the specified address and/or port in the 1340packet, recalculates IP, TCP and UDP checksums as necessary, and passes 1341it to the packet filter for evaluation. 1342.Pp 1343Since translation occurs before filtering the filter 1344engine will see packets as they look after any 1345addresses and ports have been translated. 1346Filter rules will therefore have to filter based on the translated 1347address and port number. 1348Packets that match a translation rule are only automatically passed if 1349the 1350.Ar pass 1351modifier is given, otherwise they are 1352still subject to 1353.Ar block 1354and 1355.Ar pass 1356rules. 1357.Pp 1358The state entry created permits 1359.Xr pf 4 1360to keep track of the original address for traffic associated with that state 1361and correctly direct return traffic for that connection. 1362.Pp 1363Various types of translation are possible with pf: 1364.Bl -tag -width xxxx 1365.It Ar af-to 1366Translation between different address families (NAT64) is handled 1367using 1368.Ar af-to 1369rules. 1370Because address family translation overrides the routing table, it's 1371only possible to use 1372.Ar af-to 1373on inbound rules, and a source address of the resulting translation 1374must always be specified. 1375.Pp 1376The optional second argument is the host or subnet the original 1377addresses are translated into for the destination. 1378The lowest bits of the original destination address form the host 1379part of the new destination address according to the specified subnet. 1380It is possible to embed a complete IPv4 address into an IPv6 address 1381using a network prefix of /96 or smaller. 1382.Pp 1383When a destination address is not specified it is assumed that the host 1384part is 32-bit long. 1385For IPv6 to IPv4 translation this would mean using only the lower 32 1386bits of the original IPv6 destination address. 1387For IPv4 to IPv6 translation the destination subnet defaults to the 1388subnet of the new IPv6 source address with a prefix length of /96. 1389See RFC 6052 Section 2.2 for details on how the prefix determines the 1390destination address encoding. 1391.Pp 1392For example, the following rules are identical: 1393.Bd -literal -offset indent 1394pass in inet af-to inet6 from 2001:db8::1 to 2001:db8::/96 1395pass in inet af-to inet6 from 2001:db8::1 1396.Ed 1397.Pp 1398In the above example the matching IPv4 packets will be modified to 1399have a source address of 2001:db8::1 and a destination address will 1400get prefixed with 2001:db8::/96, e.g. 198.51.100.100 will be 1401translated to 2001:db8::c633:6464. 1402.Pp 1403In the reverse case the following rules are identical: 1404.Bd -literal -offset indent 1405pass in inet6 af-to inet from 198.51.100.1 to 0.0.0.0/0 1406pass in inet6 af-to inet from 198.51.100.1 1407.Ed 1408.Pp 1409The destination IPv4 address is assumed to be embedded inside the 1410original IPv6 destination address, e.g. 64:ff9b::c633:6464 will be 1411translated to 198.51.100.100. 1412.Pp 1413The current implementation will only extract IPv4 addresses from the 1414IPv6 addresses with a prefix length of /96 and greater. 1415.It Ar binat 1416A 1417.Ar binat 1418rule specifies a bidirectional mapping between an external IP netblock 1419and an internal IP netblock. 1420.It Ar nat 1421A 1422.Ar nat 1423rule specifies that IP addresses are to be changed as the packet 1424traverses the given interface. 1425This technique allows one or more IP addresses 1426on the translating host to support network traffic for a larger range of 1427machines on an "inside" network. 1428Although in theory any IP address can be used on the inside, it is strongly 1429recommended that one of the address ranges defined by RFC 1918 be used. 1430These netblocks are: 1431.Bd -literal 143210.0.0.0 - 10.255.255.255 (all of net 10, i.e., 10/8) 1433172.16.0.0 - 172.31.255.255 (i.e., 172.16/12) 1434192.168.0.0 - 192.168.255.255 (i.e., 192.168/16) 1435.Ed 1436.It Pa rdr 1437The packet is redirected to another destination and possibly a 1438different port. 1439.Ar rdr 1440rules can optionally specify port ranges instead of single ports. 1441rdr ... port 2000:2999 -\*(Gt ... port 4000 1442redirects ports 2000 to 2999 (inclusive) to port 4000. 1443rdr ... port 2000:2999 -\*(Gt ... port 4000:* 1444redirects port 2000 to 4000, 2001 to 4001, ..., 2999 to 4999. 1445.El 1446.Pp 1447In addition to modifying the address, some translation rules may modify 1448source or destination ports for 1449.Xr tcp 4 1450or 1451.Xr udp 4 1452connections; implicitly in the case of 1453.Ar nat 1454rules and both implicitly and explicitly in the case of 1455.Ar rdr 1456rules. 1457A 1458.Ar rdr 1459rule may cause the source port to be modified if doing so avoids a conflict 1460with an existing connection. 1461A random source port in the range 50001-65535 is chosen in this case; to 1462avoid excessive CPU consumption, the number of searches for a free port is 1463limited by the 1464.Va net.pf.rdr_srcport_rewrite_tries 1465sysctl. 1466Port numbers are never translated with a 1467.Ar binat 1468rule. 1469.Pp 1470Evaluation order of the translation rules is dependent on the type 1471of the translation rules and of the direction of a packet. 1472.Ar binat 1473rules are always evaluated first. 1474Then either the 1475.Ar rdr 1476rules are evaluated on an inbound packet or the 1477.Ar nat 1478rules on an outbound packet. 1479Rules of the same type are evaluated in the same order in which they 1480appear in the ruleset. 1481The first matching rule decides what action is taken. 1482.Pp 1483The 1484.Ar no 1485option prefixed to a translation rule causes packets to remain untranslated, 1486much in the same way as 1487.Ar drop quick 1488works in the packet filter (see below). 1489If no rule matches the packet it is passed to the filter engine unmodified. 1490.Pp 1491Translation rules apply only to packets that pass through 1492the specified interface, and if no interface is specified, 1493translation is applied to packets on all interfaces. 1494For instance, redirecting port 80 on an external interface to an internal 1495web server will only work for connections originating from the outside. 1496Connections to the address of the external interface from local hosts will 1497not be redirected, since such packets do not actually pass through the 1498external interface. 1499Redirections cannot reflect packets back through the interface they arrive 1500on, they can only be redirected to hosts connected to different interfaces 1501or to the firewall itself. 1502.Pp 1503Note that redirecting external incoming connections to the loopback 1504address, as in 1505.Bd -literal -offset indent 1506rdr on ne3 inet proto tcp to port smtp -\*(Gt 127.0.0.1 port spamd 1507.Ed 1508.Pp 1509will effectively allow an external host to connect to daemons 1510bound solely to the loopback address, circumventing the traditional 1511blocking of such connections on a real interface. 1512Unless this effect is desired, any of the local non-loopback addresses 1513should be used as redirection target instead, which allows external 1514connections only to daemons bound to this address or not bound to 1515any address. 1516.Pp 1517See 1518.Sx TRANSLATION EXAMPLES 1519below. 1520.Sh PACKET FILTERING 1521.Xr pf 4 1522has the ability to 1523.Ar block 1524, 1525.Ar pass 1526and 1527.Ar match 1528packets based on attributes of their layer 3 (see 1529.Xr ip 4 1530and 1531.Xr ip6 4 ) 1532and layer 4 (see 1533.Xr icmp 4 , 1534.Xr icmp6 4 , 1535.Xr tcp 4 , 1536.Xr sctp 4 , 1537.Xr udp 4 ) 1538headers. 1539In addition, packets may also be 1540assigned to queues for the purpose of bandwidth control. 1541.Pp 1542For each packet processed by the packet filter, the filter rules are 1543evaluated in sequential order, from first to last. 1544For 1545.Ar block 1546and 1547.Ar pass 1548, the last matching rule decides what action is taken. 1549For 1550.Ar match 1551, rules are evaluated every time they match; the pass/block state of a packet 1552remains unchanged. 1553If no rule matches the packet, the default action is to pass 1554the packet. 1555.Pp 1556The following actions can be used in the filter: 1557.Bl -tag -width xxxx 1558.It Ar block 1559The packet is blocked. 1560There are a number of ways in which a 1561.Ar block 1562rule can behave when blocking a packet. 1563The default behaviour is to 1564.Ar drop 1565packets silently, however this can be overridden or made 1566explicit either globally, by setting the 1567.Ar block-policy 1568option, or on a per-rule basis with one of the following options: 1569.Pp 1570.Bl -tag -width xxxx -compact 1571.It Ar drop 1572The packet is silently dropped. 1573.It Ar return-rst 1574This applies only to 1575.Xr tcp 4 1576packets, and issues a TCP RST which closes the 1577connection. 1578.It Ar return-icmp 1579.It Ar return-icmp6 1580This causes ICMP messages to be returned for packets which match the rule. 1581By default this is an ICMP UNREACHABLE message, however this 1582can be overridden by specifying a message as a code or number. 1583.It Ar return 1584This causes a TCP RST to be returned for 1585.Xr tcp 4 1586packets, an SCTP ABORT for SCTP 1587and an ICMP UNREACHABLE for UDP and other packets. 1588.El 1589.Pp 1590Options returning ICMP packets currently have no effect if 1591.Xr pf 4 1592operates on a 1593.Xr if_bridge 4 , 1594as the code to support this feature has not yet been implemented. 1595.Pp 1596The simplest mechanism to block everything by default and only pass 1597packets that match explicit rules is specify a first filter rule of: 1598.Bd -literal -offset indent 1599block all 1600.Ed 1601.It Ar match 1602The packet is matched. 1603This mechanism is used to provide fine grained filtering without altering the 1604block/pass state of a packet. 1605.Ar match 1606rules differ from 1607.Ar block 1608and 1609.Ar pass 1610rules in that parameters are set for every rule a packet matches, not only 1611on the last matching rule. 1612For the following parameters, this means that the parameter effectively becomes 1613"sticky" until explicitly overridden: 1614.Ar queue , 1615.Ar dnpipe , 1616.Ar dnqueue , 1617.Ar rtable , 1618.Ar scrub 1619. 1620.It Ar pass 1621The packet is passed; 1622state is created unless the 1623.Ar no state 1624option is specified. 1625.El 1626.Pp 1627By default 1628.Xr pf 4 1629filters packets statefully; the first time a packet matches a 1630.Ar pass 1631rule, a state entry is created; for subsequent packets the filter checks 1632whether the packet matches any state. 1633If it does, the packet is passed without evaluation of any rules. 1634After the connection is closed or times out, the state entry is automatically 1635removed. 1636.Pp 1637This has several advantages. 1638For TCP connections, comparing a packet to a state involves checking 1639its sequence numbers, as well as TCP timestamps if a 1640.Ar scrub reassemble tcp 1641rule applies to the connection. 1642If these values are outside the narrow windows of expected 1643values, the packet is dropped. 1644This prevents spoofing attacks, such as when an attacker sends packets with 1645a fake source address/port but does not know the connection's sequence 1646numbers. 1647Similarly, 1648.Xr pf 4 1649knows how to match ICMP replies to states. 1650For example, 1651.Bd -literal -offset indent 1652pass out inet proto icmp all icmp-type echoreq 1653.Ed 1654.Pp 1655allows echo requests (such as those created by 1656.Xr ping 8 ) 1657out statefully, and matches incoming echo replies correctly to states. 1658.Pp 1659Also, looking up states is usually faster than evaluating rules. 1660If there are 50 rules, all of them are evaluated sequentially in O(n). 1661Even with 50000 states, only 16 comparisons are needed to match a 1662state, since states are stored in a binary search tree that allows 1663searches in O(log2 n). 1664.Pp 1665Furthermore, correct handling of ICMP error messages is critical to 1666many protocols, particularly TCP. 1667.Xr pf 4 1668matches ICMP error messages to the correct connection, checks them against 1669connection parameters, and passes them if appropriate. 1670For example if an ICMP source quench message referring to a stateful TCP 1671connection arrives, it will be matched to the state and get passed. 1672.Pp 1673Finally, state tracking is required for 1674.Ar nat , binat No and Ar rdr 1675rules, in order to track address and port translations and reverse the 1676translation on returning packets. 1677.Pp 1678.Xr pf 4 1679will also create state for other protocols which are effectively stateless by 1680nature. 1681UDP packets are matched to states using only host addresses and ports, 1682and other protocols are matched to states using only the host addresses. 1683.Pp 1684If stateless filtering of individual packets is desired, 1685the 1686.Ar no state 1687keyword can be used to specify that state will not be created 1688if this is the last matching rule. 1689A number of parameters can also be set to affect how 1690.Xr pf 4 1691handles state tracking. 1692See 1693.Sx STATEFUL TRACKING OPTIONS 1694below for further details. 1695.Sh PARAMETERS 1696The rule parameters specify the packets to which a rule applies. 1697A packet always comes in on, or goes out through, one interface. 1698Most parameters are optional. 1699If a parameter is specified, the rule only applies to packets with 1700matching attributes. 1701Certain parameters can be expressed as lists, in which case 1702.Xr pfctl 8 1703generates all needed rule combinations. 1704.Bl -tag -width xxxx 1705.It Ar in No or Ar out 1706This rule applies to incoming or outgoing packets. 1707If neither 1708.Ar in 1709nor 1710.Ar out 1711are specified, the rule will match packets in both directions. 1712.It Ar log 1713In addition to the action specified, a log message is generated. 1714Only the packet that establishes the state is logged, 1715unless the 1716.Ar no state 1717option is specified. 1718The logged packets are sent to a 1719.Xr pflog 4 1720interface, by default 1721.Ar pflog0 . 1722This interface is monitored by the 1723.Xr pflogd 8 1724logging daemon, which dumps the logged packets to the file 1725.Pa /var/log/pflog 1726in 1727.Xr pcap 3 1728binary format. 1729.It Ar log (all) 1730Used to force logging of all packets for a connection. 1731This is not necessary when 1732.Ar no state 1733is explicitly specified. 1734As with 1735.Ar log , 1736packets are logged to 1737.Xr pflog 4 . 1738.It Ar log (matches) 1739Used to force logging of this packet on all subsequent matching rules. 1740.It Ar log (user) 1741Logs the 1742.Ux 1743user ID of the user that owns the socket and the PID of the process that 1744has the socket open where the packet is sourced from or destined to 1745(depending on which socket is local). 1746This is in addition to the normal information logged. 1747.Pp 1748Only the first packet 1749logged via 1750.Ar log (all, user) 1751will have the user credentials logged when using stateful matching. 1752.It Ar log (to Aq Ar interface ) 1753Send logs to the specified 1754.Xr pflog 4 1755interface instead of 1756.Ar pflog0 . 1757.It Ar quick 1758If a packet matches a rule which has the 1759.Ar quick 1760option set, this rule 1761is considered the last matching rule, and evaluation of subsequent rules 1762is skipped. 1763.It Ar on Aq Ar interface 1764This rule applies only to packets coming in on, or going out through, this 1765particular interface or interface group. 1766For more information on interface groups, 1767see the 1768.Ic group 1769keyword in 1770.Xr ifconfig 8 . 1771.It Aq Ar af 1772This rule applies only to packets of this address family. 1773Supported values are 1774.Ar inet 1775and 1776.Ar inet6 . 1777.It Ar proto Aq Ar protocol 1778This rule applies only to packets of this protocol. 1779Common protocols are 1780.Xr icmp 4 , 1781.Xr icmp6 4 , 1782.Xr tcp 4 , 1783.Xr sctp 4 , 1784and 1785.Xr udp 4 . 1786For a list of all the protocol name to number mappings used by 1787.Xr pfctl 8 , 1788see the file 1789.Pa /etc/protocols . 1790.It Xo 1791.Ar from Aq Ar source 1792.Ar port Aq Ar source 1793.Ar os Aq Ar source 1794.Ar to Aq Ar dest 1795.Ar port Aq Ar dest 1796.Xc 1797This rule applies only to packets with the specified source and destination 1798addresses and ports. 1799.Pp 1800Addresses can be specified in CIDR notation (matching netblocks), as 1801symbolic host names, interface names or interface group names, or as any 1802of the following keywords: 1803.Pp 1804.Bl -tag -width xxxxxxxxxxxxxx -compact 1805.It Ar any 1806Any address. 1807.It Ar no-route 1808Any address which is not currently routable. 1809.It Ar urpf-failed 1810Any source address that fails a unicast reverse path forwarding (URPF) 1811check, i.e. packets coming in on an interface other than that which holds 1812the route back to the packet's source address. 1813.It Ar self 1814Expands to all addresses assigned to all interfaces. 1815.It Aq Ar table 1816Any address that matches the given table. 1817.El 1818.Pp 1819Ranges of addresses are specified by using the 1820.Sq - 1821operator. 1822For instance: 1823.Dq 10.1.1.10 - 10.1.1.12 1824means all addresses from 10.1.1.10 to 10.1.1.12, 1825hence addresses 10.1.1.10, 10.1.1.11, and 10.1.1.12. 1826.Pp 1827Interface names and interface group names, and 1828.Ar self 1829can have modifiers appended: 1830.Pp 1831.Bl -tag -width xxxxxxxxxxxx -compact 1832.It Ar :network 1833Translates to the network(s) attached to the interface. 1834.It Ar :broadcast 1835Translates to the interface's broadcast address(es). 1836.It Ar :peer 1837Translates to the point-to-point interface's peer address(es). 1838.It Ar :0 1839Do not include interface aliases. 1840.El 1841.Pp 1842Host names may also have the 1843.Ar :0 1844option appended to restrict the name resolution to the first of each 1845v4 and non-link-local v6 address found. 1846.Pp 1847Host name resolution and interface to address translation are done at 1848ruleset load-time. 1849When the address of an interface (or host name) changes (under DHCP or PPP, 1850for instance), the ruleset must be reloaded for the change to be reflected 1851in the kernel. 1852Surrounding the interface name (and optional modifiers) in parentheses 1853changes this behaviour. 1854When the interface name is surrounded by parentheses, the rule is 1855automatically updated whenever the interface changes its address. 1856The ruleset does not need to be reloaded. 1857This is especially useful with 1858.Ar nat . 1859.Pp 1860Ports can be specified either by number or by name. 1861For example, port 80 can be specified as 1862.Em www . 1863For a list of all port name to number mappings used by 1864.Xr pfctl 8 , 1865see the file 1866.Pa /etc/services . 1867.Pp 1868Ports and ranges of ports are specified by using these operators: 1869.Bd -literal -offset indent 1870= (equal) 1871!= (unequal) 1872\*(Lt (less than) 1873\*(Le (less than or equal) 1874\*(Gt (greater than) 1875\*(Ge (greater than or equal) 1876: (range including boundaries) 1877\*(Gt\*(Lt (range excluding boundaries) 1878\*(Lt\*(Gt (except range) 1879.Ed 1880.Pp 1881.Sq \*(Gt\*(Lt , 1882.Sq \*(Lt\*(Gt 1883and 1884.Sq \&: 1885are binary operators (they take two arguments). 1886For instance: 1887.Bl -tag -width Fl 1888.It Ar port 2000:2004 1889means 1890.Sq all ports \*(Ge 2000 and \*(Le 2004 , 1891hence ports 2000, 2001, 2002, 2003 and 2004. 1892.It Ar port 2000 \*(Gt\*(Lt 2004 1893means 1894.Sq all ports \*(Gt 2000 and \*(Lt 2004 , 1895hence ports 2001, 2002 and 2003. 1896.It Ar port 2000 \*(Lt\*(Gt 2004 1897means 1898.Sq all ports \*(Lt 2000 or \*(Gt 2004 , 1899hence ports 1-1999 and 2005-65535. 1900.El 1901.Pp 1902The operating system of the source host can be specified in the case of TCP 1903rules with the 1904.Ar OS 1905modifier. 1906See the 1907.Sx OPERATING SYSTEM FINGERPRINTING 1908section for more information. 1909.Pp 1910The host, port and OS specifications are optional, as in the following examples: 1911.Bd -literal -offset indent 1912pass in all 1913pass in from any to any 1914pass in proto tcp from any port \*(Le 1024 to any 1915pass in proto tcp from any to any port 25 1916pass in proto tcp from 10.0.0.0/8 port \*(Gt 1024 \e 1917 to ! 10.1.2.3 port != ssh 1918pass in proto tcp from any os "OpenBSD" 1919.Ed 1920.It Ar all 1921This is equivalent to "from any to any". 1922.It Ar group Aq Ar group 1923Similar to 1924.Ar user , 1925this rule only applies to packets of sockets owned by the specified group. 1926.It Ar user Aq Ar user 1927This rule only applies to packets of sockets owned by the specified user. 1928For outgoing connections initiated from the firewall, this is the user 1929that opened the connection. 1930For incoming connections to the firewall itself, this is the user that 1931listens on the destination port. 1932For forwarded connections, where the firewall is not a connection endpoint, 1933the user and group are 1934.Em unknown . 1935.Pp 1936All packets, both outgoing and incoming, of one connection are associated 1937with the same user and group. 1938Only TCP and UDP packets can be associated with users; for other protocols 1939these parameters are ignored. 1940.Pp 1941User and group refer to the effective (as opposed to the real) IDs, in 1942case the socket is created by a setuid/setgid process. 1943User and group IDs are stored when a socket is created; 1944when a process creates a listening socket as root (for instance, by 1945binding to a privileged port) and subsequently changes to another 1946user ID (to drop privileges), the credentials will remain root. 1947.Pp 1948User and group IDs can be specified as either numbers or names. 1949The syntax is similar to the one for ports. 1950The value 1951.Em unknown 1952matches packets of forwarded connections. 1953.Em unknown 1954can only be used with the operators 1955.Cm = 1956and 1957.Cm != . 1958Other constructs like 1959.Cm user \*(Ge unknown 1960are invalid. 1961Forwarded packets with unknown user and group ID match only rules 1962that explicitly compare against 1963.Em unknown 1964with the operators 1965.Cm = 1966or 1967.Cm != . 1968For instance 1969.Cm user \*(Ge 0 1970does not match forwarded packets. 1971The following example allows only selected users to open outgoing 1972connections: 1973.Bd -literal -offset indent 1974block out proto { tcp, udp } all 1975pass out proto { tcp, udp } all user { \*(Lt 1000, dhartmei } 1976.Ed 1977.It Xo Ar flags Aq Ar a 1978.Pf / Ns Aq Ar b 1979.No \*(Ba / Ns Aq Ar b 1980.No \*(Ba any 1981.Xc 1982This rule only applies to TCP packets that have the flags 1983.Aq Ar a 1984set out of set 1985.Aq Ar b . 1986Flags not specified in 1987.Aq Ar b 1988are ignored. 1989For stateful connections, the default is 1990.Ar flags S/SA . 1991To indicate that flags should not be checked at all, specify 1992.Ar flags any . 1993The flags are: (F)IN, (S)YN, (R)ST, (P)USH, (A)CK, (U)RG, (E)CE, and C(W)R. 1994.Bl -tag -width Fl 1995.It Ar flags S/S 1996Flag SYN is set. 1997The other flags are ignored. 1998.It Ar flags S/SA 1999This is the default setting for stateful connections. 2000Out of SYN and ACK, exactly SYN may be set. 2001SYN, SYN+PSH and SYN+RST match, but SYN+ACK, ACK and ACK+RST do not. 2002This is more restrictive than the previous example. 2003.It Ar flags /SFRA 2004If the first set is not specified, it defaults to none. 2005All of SYN, FIN, RST and ACK must be unset. 2006.El 2007.Pp 2008Because 2009.Ar flags S/SA 2010is applied by default (unless 2011.Ar no state 2012is specified), only the initial SYN packet of a TCP handshake will create 2013a state for a TCP connection. 2014It is possible to be less restrictive, and allow state creation from 2015intermediate 2016.Pq non-SYN 2017packets, by specifying 2018.Ar flags any . 2019This will cause 2020.Xr pf 4 2021to synchronize to existing connections, for instance 2022if one flushes the state table. 2023However, states created from such intermediate packets may be missing 2024connection details such as the TCP window scaling factor. 2025States which modify the packet flow, such as those affected by 2026.Ar af-to, 2027.Ar nat, 2028.Ar binat or 2029.Ar rdr 2030rules, 2031.Ar modulate No or Ar synproxy state 2032options, or scrubbed with 2033.Ar reassemble tcp 2034will also not be recoverable from intermediate packets. 2035Such connections will stall and time out. 2036.It Xo Ar icmp-type Aq Ar type 2037.Ar code Aq Ar code 2038.Xc 2039.It Xo Ar icmp6-type Aq Ar type 2040.Ar code Aq Ar code 2041.Xc 2042This rule only applies to ICMP or ICMPv6 packets with the specified type 2043and code. 2044Text names for ICMP types and codes are listed in 2045.Xr icmp 4 2046and 2047.Xr icmp6 4 . 2048This parameter is only valid for rules that cover protocols ICMP or 2049ICMP6. 2050The protocol and the ICMP type indicator 2051.Po 2052.Ar icmp-type 2053or 2054.Ar icmp6-type 2055.Pc 2056must match. 2057.It Xo Ar tos Aq Ar string 2058.No \*(Ba Aq Ar number 2059.Xc 2060This rule applies to packets with the specified 2061.Em TOS 2062bits set. 2063.Em TOS 2064may be 2065given as one of 2066.Ar critical , 2067.Ar inetcontrol , 2068.Ar lowdelay , 2069.Ar netcontrol , 2070.Ar throughput , 2071.Ar reliability , 2072or one of the DiffServ Code Points: 2073.Ar ef , 2074.Ar va , 2075.Ar af11 No ... Ar af43 , 2076.Ar cs0 No ... Ar cs7 ; 2077or as either hex or decimal. 2078.Pp 2079For example, the following rules are identical: 2080.Bd -literal -offset indent 2081pass all tos lowdelay 2082pass all tos 0x10 2083pass all tos 16 2084.Ed 2085.It Ar allow-opts 2086By default, IPv4 packets with IP options or IPv6 packets with routing 2087extension headers are blocked. 2088When 2089.Ar allow-opts 2090is specified for a 2091.Ar pass 2092rule, packets that pass the filter based on that rule (last matching) 2093do so even if they contain IP options or routing extension headers. 2094For packets that match state, the rule that initially created the 2095state is used. 2096The implicit 2097.Ar pass 2098rule that is used when a packet does not match any rules does not 2099allow IP options. 2100.It Ar label Aq Ar string 2101Adds a label (name) to the rule, which can be used to identify the rule. 2102For instance, 2103pfctl -s labels 2104shows per-rule statistics for rules that have labels. 2105.Pp 2106The following macros can be used in labels: 2107.Pp 2108.Bl -tag -width $srcaddr -compact -offset indent 2109.It Ar $if 2110The interface. 2111.It Ar $srcaddr 2112The source IP address. 2113.It Ar $dstaddr 2114The destination IP address. 2115.It Ar $srcport 2116The source port specification. 2117.It Ar $dstport 2118The destination port specification. 2119.It Ar $proto 2120The protocol name. 2121.It Ar $nr 2122The rule number. 2123.El 2124.Pp 2125For example: 2126.Bd -literal -offset indent 2127ips = \&"{ 1.2.3.4, 1.2.3.5 }\&" 2128pass in proto tcp from any to $ips \e 2129 port \*(Gt 1023 label \&"$dstaddr:$dstport\&" 2130.Ed 2131.Pp 2132expands to 2133.Bd -literal -offset indent 2134pass in inet proto tcp from any to 1.2.3.4 \e 2135 port \*(Gt 1023 label \&"1.2.3.4:\*(Gt1023\&" 2136pass in inet proto tcp from any to 1.2.3.5 \e 2137 port \*(Gt 1023 label \&"1.2.3.5:\*(Gt1023\&" 2138.Ed 2139.Pp 2140The macro expansion for the 2141.Ar label 2142directive occurs only at configuration file parse time, not during runtime. 2143.It Ar ridentifier Aq Ar number 2144Add an identifier (number) to the rule, which can be used to correlate the rule 2145to pflog entries, even after ruleset updates. 2146.It Xo Ar queue Aq Ar queue 2147.No \*(Ba ( Aq Ar queue , 2148.Aq Ar queue ) 2149.Xc 2150Packets matching this rule will be assigned to the specified queue. 2151If two queues are given, packets which have a 2152.Em TOS 2153of 2154.Em lowdelay 2155and TCP ACKs with no data payload will be assigned to the second one. 2156See 2157.Sx QUEUEING 2158for setup details. 2159.Pp 2160For example: 2161.Bd -literal -offset indent 2162pass in proto tcp to port 25 queue mail 2163pass in proto tcp to port 22 queue(ssh_bulk, ssh_prio) 2164.Ed 2165.It Cm set prio Ar priority | Pq Ar priority , priority 2166Packets matching this rule will be assigned a specific queueing priority. 2167Priorities are assigned as integers 0 through 7. 2168If the packet is transmitted on a 2169.Xr vlan 4 2170interface, the queueing priority will be written as the priority 2171code point in the 802.1Q VLAN header. 2172If two priorities are given, packets which have a TOS of 2173.Cm lowdelay 2174and TCP ACKs with no data payload will be assigned to the second one. 2175.Pp 2176For example: 2177.Bd -literal -offset indent 2178pass in proto tcp to port 25 set prio 2 2179pass in proto tcp to port 22 set prio (2, 5) 2180.Ed 2181.It Ar received-on Aq Ar interface 2182Only match packets which were received on the specified 2183.Ar interface 2184(or interface group). 2185.It Ar tag Aq Ar string 2186Packets matching this rule will be tagged with the 2187specified string. 2188The tag acts as an internal marker that can be used to 2189identify these packets later on. 2190This can be used, for example, to provide trust between 2191interfaces and to determine if packets have been 2192processed by translation rules. 2193Tags are 2194.Qq sticky , 2195meaning that the packet will be tagged even if the rule 2196is not the last matching rule. 2197Further matching rules can replace the tag with a 2198new one but will not remove a previously applied tag. 2199A packet is only ever assigned one tag at a time. 2200Packet tagging can be done during 2201.Ar nat , 2202.Ar rdr , 2203.Ar binat 2204or 2205.Ar ether 2206rules in addition to filter rules. 2207Tags take the same macros as labels (see above). 2208.It Ar tagged Aq Ar string 2209Used with filter, translation or scrub rules 2210to specify that packets must already 2211be tagged with the given tag in order to match the rule. 2212Inverse tag matching can also be done 2213by specifying the 2214.Cm !\& 2215operator before the 2216.Ar tagged 2217keyword. 2218.It Ar rtable Aq Ar number 2219Used to select an alternate routing table for the routing lookup. 2220Only effective before the route lookup happened, i.e. when filtering inbound. 2221.It Xo Ar divert-to Aq Ar host 2222.Ar port Aq Ar port 2223.Xc 2224Used to 2225.Xr divert 4 2226packets to the given divert 2227.Ar port . 2228Historically 2229.Ox pf has another meaning for this, and 2230.Fx pf uses 2231this syntax to support 2232.Xr divert 4 instead. Hence, 2233.Ar host 2234has no meaning and can be set to anything like 127.0.0.1. 2235If a packet is re-injected and does not change direction then it will not be 2236re-diverted. 2237.It Ar divert-reply 2238It has no meaning in 2239.Fx pf . 2240.It Ar probability Aq Ar number 2241A probability attribute can be attached to a rule, with a value set between 22420 and 1, bounds not included. 2243In that case, the rule will be honoured using the given probability value 2244only. 2245For example, the following rule will drop 20% of incoming ICMP packets: 2246.Bd -literal -offset indent 2247block in proto icmp probability 20% 2248.Ed 2249.It Ar prio Aq Ar number 2250Only match packets which have the given queueing priority assigned. 2251.El 2252.Sh ROUTING 2253If a packet matches a rule with a route option set, the packet filter will 2254route the packet according to the type of route option. 2255When such a rule creates state, the route option is also applied to all 2256packets matching the same connection. 2257.Bl -tag -width xxxx 2258.It Ar route-to 2259The 2260.Ar route-to 2261option routes the packet to the specified interface with an optional address 2262for the next hop. 2263When a 2264.Ar route-to 2265rule creates state, only packets that pass in the same direction as the 2266filter rule specifies will be routed in this way. 2267Packets passing in the opposite direction (replies) are not affected 2268and are routed normally. 2269.It Ar reply-to 2270The 2271.Ar reply-to 2272option is similar to 2273.Ar route-to , 2274but routes packets that pass in the opposite direction (replies) to the 2275specified interface. 2276Opposite direction is only defined in the context of a state entry, and 2277.Ar reply-to 2278is useful only in rules that create state. 2279It can be used on systems with multiple external connections to 2280route all outgoing packets of a connection through the interface 2281the incoming connection arrived through (symmetric routing enforcement). 2282.It Ar dup-to 2283The 2284.Ar dup-to 2285option creates a duplicate of the packet and routes it like 2286.Ar route-to . 2287The original packet gets routed as it normally would. 2288.El 2289.Sh POOL OPTIONS 2290For 2291.Ar nat 2292and 2293.Ar rdr 2294rules, (as well as for the 2295.Ar route-to , 2296.Ar reply-to 2297and 2298.Ar dup-to 2299rule options) for which there is a single redirection address which has a 2300subnet mask smaller than 32 for IPv4 or 128 for IPv6 (more than one IP 2301address), a variety of different methods for assigning this address can be 2302used: 2303.Bl -tag -width xxxx 2304.It Ar bitmask 2305The 2306.Ar bitmask 2307option applies the network portion of the redirection address to the address 2308to be modified (source with 2309.Ar nat , 2310destination with 2311.Ar rdr ) . 2312.It Ar random 2313The 2314.Ar random 2315option selects an address at random within the defined block of addresses. 2316.It Ar source-hash 2317The 2318.Ar source-hash 2319option uses a hash of the source address to determine the redirection address, 2320ensuring that the redirection address is always the same for a given source. 2321An optional key can be specified after this keyword either in hex or as a 2322string; by default 2323.Xr pfctl 8 2324randomly generates a key for source-hash every time the 2325ruleset is reloaded. 2326.It Ar round-robin 2327The 2328.Ar round-robin 2329option loops through the redirection address(es). 2330.Pp 2331When more than one redirection address is specified, 2332.Ar round-robin 2333is the only permitted pool type. 2334.It Ar static-port 2335With 2336.Ar nat 2337rules, the 2338.Ar static-port 2339option prevents 2340.Xr pf 4 2341from modifying the source port on TCP and UDP packets. 2342.It Xo Ar map-e-portset Aq Ar psid-offset 2343.No / Aq Ar psid-len 2344.No / Aq Ar psid 2345.Xc 2346With 2347.Ar nat 2348rules, the 2349.Ar map-e-portset 2350option enables the source port translation of MAP-E (RFC 7597) Customer Edge. 2351In order to make the host act as a MAP-E Customer Edge, setting up a tunneling 2352interface and pass rules for encapsulated packets are required in addition 2353to the map-e-portset nat rule. 2354.Pp 2355For example: 2356.Bd -literal -offset indent 2357nat on $gif_mape_if from $int_if:network to any \e 2358 -> $ipv4_mape_src map-e-portset 6/8/0x34 2359.Ed 2360.Pp 2361sets PSID offset 6, PSID length 8, PSID 0x34. 2362.It Ar endpoint-independent 2363With 2364.Ar nat 2365rules, the 2366.Ar endpoint-independent 2367option caues 2368.Xr pf 4 2369to always map connections from a UDP source address and port to the same 2370NAT address and port. 2371This feature implements "full-cone" NAT behavior. 2372.El 2373.Pp 2374Additionally, the 2375.Ar sticky-address 2376option can be specified to help ensure that multiple connections from the 2377same source are mapped to the same redirection address. 2378This option can be used with the 2379.Ar random 2380and 2381.Ar round-robin 2382pool options. 2383Note that by default these associations are destroyed as soon as there are 2384no longer states which refer to them; in order to make the mappings last 2385beyond the lifetime of the states, increase the global options with 2386.Ar set timeout src.track . 2387See 2388.Sx STATEFUL TRACKING OPTIONS 2389for more ways to control the source tracking. 2390.Sh STATE MODULATION 2391Much of the security derived from TCP is attributable to how well the 2392initial sequence numbers (ISNs) are chosen. 2393Some popular stack implementations choose 2394.Em very 2395poor ISNs and thus are normally susceptible to ISN prediction exploits. 2396By applying a 2397.Ar modulate state 2398rule to a TCP connection, 2399.Xr pf 4 2400will create a high quality random sequence number for each connection 2401endpoint. 2402.Pp 2403The 2404.Ar modulate state 2405directive implicitly keeps state on the rule and is 2406only applicable to TCP connections. 2407.Pp 2408For instance: 2409.Bd -literal -offset indent 2410block all 2411pass out proto tcp from any to any modulate state 2412pass in proto tcp from any to any port 25 flags S/SFRA modulate state 2413.Ed 2414.Pp 2415Note that modulated connections will not recover when the state table 2416is lost (firewall reboot, flushing the state table, etc...). 2417.Xr pf 4 2418will not be able to infer a connection again after the state table flushes 2419the connection's modulator. 2420When the state is lost, the connection may be left dangling until the 2421respective endpoints time out the connection. 2422It is possible on a fast local network for the endpoints to start an ACK 2423storm while trying to resynchronize after the loss of the modulator. 2424The default 2425.Ar flags 2426settings (or a more strict equivalent) should be used on 2427.Ar modulate state 2428rules to prevent ACK storms. 2429.Pp 2430Note that alternative methods are available 2431to prevent loss of the state table 2432and allow for firewall failover. 2433See 2434.Xr carp 4 2435and 2436.Xr pfsync 4 2437for further information. 2438.Sh SYN PROXY 2439By default, 2440.Xr pf 4 2441passes packets that are part of a 2442.Xr tcp 4 2443handshake between the endpoints. 2444The 2445.Ar synproxy state 2446option can be used to cause 2447.Xr pf 4 2448itself to complete the handshake with the active endpoint, perform a handshake 2449with the passive endpoint, and then forward packets between the endpoints. 2450.Pp 2451No packets are sent to the passive endpoint before the active endpoint has 2452completed the handshake, hence so-called SYN floods with spoofed source 2453addresses will not reach the passive endpoint, as the sender can't complete the 2454handshake. 2455.Pp 2456The proxy is transparent to both endpoints, they each see a single 2457connection from/to the other endpoint. 2458.Xr pf 4 2459chooses random initial sequence numbers for both handshakes. 2460Once the handshakes are completed, the sequence number modulators 2461(see previous section) are used to translate further packets of the 2462connection. 2463.Ar synproxy state 2464includes 2465.Ar modulate state . 2466.Pp 2467Rules with 2468.Ar synproxy 2469will not work if 2470.Xr pf 4 2471operates on a 2472.Xr bridge 4 . 2473.Pp 2474Example: 2475.Bd -literal -offset indent 2476pass in proto tcp from any to any port www synproxy state 2477.Ed 2478.Sh STATEFUL TRACKING OPTIONS 2479A number of options related to stateful tracking can be applied on a 2480per-rule basis. 2481.Ar keep state , 2482.Ar modulate state 2483and 2484.Ar synproxy state 2485support these options, and 2486.Ar keep state 2487must be specified explicitly to apply options to a rule. 2488.Pp 2489.Bl -tag -width xxxx -compact 2490.It Ar max Aq Ar number 2491Limits the number of concurrent states the rule may create. 2492When this limit is reached, further packets that would create 2493state are dropped until existing states time out. 2494.It Ar no-sync 2495Prevent state changes for states created by this rule from appearing on the 2496.Xr pfsync 4 2497interface. 2498.It Xo Aq Ar timeout 2499.Aq Ar seconds 2500.Xc 2501Changes the timeout values used for states created by this rule. 2502For a list of all valid timeout names, see 2503.Sx OPTIONS 2504above. 2505.It Ar sloppy 2506Uses a sloppy TCP connection tracker that does not check sequence 2507numbers at all, which makes insertion and ICMP teardown attacks way 2508easier. 2509This is intended to be used in situations where one does not see all 2510packets of a connection, e.g. in asymmetric routing situations. 2511Cannot be used with modulate or synproxy state. 2512.It Ar pflow 2513States created by this rule are exported on the 2514.Xr pflow 4 2515interface. 2516.It Ar allow-related 2517Automatically allow connections related to this one, regardless of rules that 2518might otherwise affect them. 2519This currently only applies to SCTP multihomed connection. 2520.El 2521.Pp 2522Multiple options can be specified, separated by commas: 2523.Bd -literal -offset indent 2524pass in proto tcp from any to any \e 2525 port www keep state \e 2526 (max 100, source-track rule, max-src-nodes 75, \e 2527 max-src-states 3, tcp.established 60, tcp.closing 5) 2528.Ed 2529.Pp 2530When the 2531.Ar source-track 2532keyword is specified, the number of states per source IP is tracked. 2533.Pp 2534.Bl -tag -width xxxx -compact 2535.It Ar source-track rule 2536The maximum number of states created by this rule is limited by the rule's 2537.Ar max-src-nodes 2538and 2539.Ar max-src-states 2540options. 2541Only state entries created by this particular rule count toward the rule's 2542limits. 2543.It Ar source-track global 2544The number of states created by all rules that use this option is limited. 2545Each rule can specify different 2546.Ar max-src-nodes 2547and 2548.Ar max-src-states 2549options, however state entries created by any participating rule count towards 2550each individual rule's limits. 2551.El 2552.Pp 2553The following limits can be set: 2554.Pp 2555.Bl -tag -width xxxx -compact 2556.It Ar max-src-nodes Aq Ar number 2557Limits the maximum number of source addresses which can simultaneously 2558have state table entries. 2559.It Ar max-src-states Aq Ar number 2560Limits the maximum number of simultaneous state entries that a single 2561source address can create with this rule. 2562.El 2563.Pp 2564For stateful TCP connections, limits on established connections (connections 2565which have completed the TCP 3-way handshake) can also be enforced 2566per source IP. 2567.Pp 2568.Bl -tag -width xxxx -compact 2569.It Ar max-src-conn Aq Ar number 2570Limits the maximum number of simultaneous TCP connections which have 2571completed the 3-way handshake that a single host can make. 2572.It Xo Ar max-src-conn-rate Aq Ar number 2573.No / Aq Ar seconds 2574.Xc 2575Limit the rate of new connections over a time interval. 2576The connection rate is an approximation calculated as a moving average. 2577.El 2578.Pp 2579When one of these limits is reached, further packets that would create 2580state are dropped until existing states time out. 2581.Pp 2582Because the 3-way handshake ensures that the source address is not being 2583spoofed, more aggressive action can be taken based on these limits. 2584With the 2585.Ar overload Aq Ar table 2586state option, source IP addresses which hit either of the limits on 2587established connections will be added to the named table. 2588This table can be used in the ruleset to block further activity from 2589the offending host, redirect it to a tarpit process, or restrict its 2590bandwidth. 2591.Pp 2592The optional 2593.Ar flush 2594keyword kills all states created by the matching rule which originate 2595from the host which exceeds these limits. 2596The 2597.Ar global 2598modifier to the flush command kills all states originating from the 2599offending host, regardless of which rule created the state. 2600.Pp 2601For example, the following rules will protect the webserver against 2602hosts making more than 100 connections in 10 seconds. 2603Any host which connects faster than this rate will have its address added 2604to the 2605.Aq bad_hosts 2606table and have all states originating from it flushed. 2607Any new packets arriving from this host will be dropped unconditionally 2608by the block rule. 2609.Bd -literal -offset indent 2610block quick from \*(Ltbad_hosts\*(Gt 2611pass in on $ext_if proto tcp to $webserver port www keep state \e 2612 (max-src-conn-rate 100/10, overload \*(Ltbad_hosts\*(Gt flush global) 2613.Ed 2614.Sh OPERATING SYSTEM FINGERPRINTING 2615Passive OS Fingerprinting is a mechanism to inspect nuances of a TCP 2616connection's initial SYN packet and guess at the host's operating system. 2617Unfortunately these nuances are easily spoofed by an attacker so the 2618fingerprint is not useful in making security decisions. 2619But the fingerprint is typically accurate enough to make policy decisions 2620upon. 2621.Pp 2622The fingerprints may be specified by operating system class, by 2623version, or by subtype/patchlevel. 2624The class of an operating system is typically the vendor or genre 2625and would be 2626.Ox 2627for the 2628.Xr pf 4 2629firewall itself. 2630The version of the oldest available 2631.Ox 2632release on the main FTP site 2633would be 2.6 and the fingerprint would be written 2634.Pp 2635.Dl \&"OpenBSD 2.6\&" 2636.Pp 2637The subtype of an operating system is typically used to describe the 2638patchlevel if that patch led to changes in the TCP stack behavior. 2639In the case of 2640.Ox , 2641the only subtype is for a fingerprint that was 2642normalized by the 2643.Ar no-df 2644scrub option and would be specified as 2645.Pp 2646.Dl \&"OpenBSD 3.3 no-df\&" 2647.Pp 2648Fingerprints for most popular operating systems are provided by 2649.Xr pf.os 5 . 2650Once 2651.Xr pf 4 2652is running, a complete list of known operating system fingerprints may 2653be listed by running: 2654.Pp 2655.Dl # pfctl -so 2656.Pp 2657Filter rules can enforce policy at any level of operating system specification 2658assuming a fingerprint is present. 2659Policy could limit traffic to approved operating systems or even ban traffic 2660from hosts that aren't at the latest service pack. 2661.Pp 2662The 2663.Ar unknown 2664class can also be used as the fingerprint which will match packets for 2665which no operating system fingerprint is known. 2666.Pp 2667Examples: 2668.Bd -literal -offset indent 2669pass out proto tcp from any os OpenBSD 2670block out proto tcp from any os Doors 2671block out proto tcp from any os "Doors PT" 2672block out proto tcp from any os "Doors PT SP3" 2673block out from any os "unknown" 2674pass on lo0 proto tcp from any os "OpenBSD 3.3 lo0" 2675.Ed 2676.Pp 2677Operating system fingerprinting is limited only to the TCP SYN packet. 2678This means that it will not work on other protocols and will not match 2679a currently established connection. 2680.Pp 2681Caveat: operating system fingerprints are occasionally wrong. 2682There are three problems: an attacker can trivially craft his packets to 2683appear as any operating system he chooses; 2684an operating system patch could change the stack behavior and no fingerprints 2685will match it until the database is updated; 2686and multiple operating systems may have the same fingerprint. 2687.Sh BLOCKING SPOOFED TRAFFIC 2688"Spoofing" is the faking of IP addresses, typically for malicious 2689purposes. 2690The 2691.Ar antispoof 2692directive expands to a set of filter rules which will block all 2693traffic with a source IP from the network(s) directly connected 2694to the specified interface(s) from entering the system through 2695any other interface. 2696.Pp 2697For example, the line 2698.Bd -literal -offset indent 2699antispoof for lo0 2700.Ed 2701.Pp 2702expands to 2703.Bd -literal -offset indent 2704block drop in on ! lo0 inet from 127.0.0.1/8 to any 2705block drop in on ! lo0 inet6 from ::1 to any 2706.Ed 2707.Pp 2708For non-loopback interfaces, there are additional rules to block incoming 2709packets with a source IP address identical to the interface's IP(s). 2710For example, assuming the interface wi0 had an IP address of 10.0.0.1 and a 2711netmask of 255.255.255.0, 2712the line 2713.Bd -literal -offset indent 2714antispoof for wi0 inet 2715.Ed 2716.Pp 2717expands to 2718.Bd -literal -offset indent 2719block drop in on ! wi0 inet from 10.0.0.0/24 to any 2720block drop in inet from 10.0.0.1 to any 2721.Ed 2722.Pp 2723Caveat: Rules created by the 2724.Ar antispoof 2725directive interfere with packets sent over loopback interfaces 2726to local addresses. 2727One should pass these explicitly. 2728.Sh FRAGMENT HANDLING 2729The size of IP datagrams (packets) can be significantly larger than the 2730maximum transmission unit (MTU) of the network. 2731In cases when it is necessary or more efficient to send such large packets, 2732the large packet will be fragmented into many smaller packets that will each 2733fit onto the wire. 2734Unfortunately for a firewalling device, only the first logical fragment will 2735contain the necessary header information for the subprotocol that allows 2736.Xr pf 4 2737to filter on things such as TCP ports or to perform NAT. 2738.Pp 2739Besides the use of 2740.Ar set reassemble 2741option or 2742.Ar scrub 2743rules as described in 2744.Sx TRAFFIC NORMALIZATION 2745above, there are three options for handling fragments in the packet filter. 2746.Pp 2747One alternative is to filter individual fragments with filter rules. 2748If no 2749.Ar scrub 2750rule applies to a fragment or 2751.Ar set reassemble 2752is set to 2753.Cm no 2754, it is passed to the filter. 2755Filter rules with matching IP header parameters decide whether the 2756fragment is passed or blocked, in the same way as complete packets 2757are filtered. 2758Without reassembly, fragments can only be filtered based on IP header 2759fields (source/destination address, protocol), since subprotocol header 2760fields are not available (TCP/UDP port numbers, ICMP code/type). 2761The 2762.Ar fragment 2763option can be used to restrict filter rules to apply only to 2764fragments, but not complete packets. 2765Filter rules without the 2766.Ar fragment 2767option still apply to fragments, if they only specify IP header fields. 2768For instance, the rule 2769.Bd -literal -offset indent 2770pass in proto tcp from any to any port 80 2771.Ed 2772.Pp 2773never applies to a fragment, even if the fragment is part of a TCP 2774packet with destination port 80, because without reassembly this information 2775is not available for each fragment. 2776This also means that fragments cannot create new or match existing 2777state table entries, which makes stateful filtering and address 2778translation (NAT, redirection) for fragments impossible. 2779.Pp 2780It's also possible to reassemble only certain fragments by specifying 2781source or destination addresses or protocols as parameters in 2782.Ar scrub 2783rules. 2784.Pp 2785In most cases, the benefits of reassembly outweigh the additional 2786memory cost, and it's recommended to use 2787.Ar set reassemble 2788option or 2789.Ar scrub 2790rules with the 2791.Ar fragment reassemble 2792modifier to reassemble 2793all fragments. 2794.Pp 2795The memory allocated for fragment caching can be limited using 2796.Xr pfctl 8 . 2797Once this limit is reached, fragments that would have to be cached 2798are dropped until other entries time out. 2799The timeout value can also be adjusted. 2800.Pp 2801When forwarding reassembled IPv6 packets, pf refragments them with 2802the original maximum fragment size. 2803This allows the sender to determine the optimal fragment size by 2804path MTU discovery. 2805.Sh ANCHORS 2806Besides the main ruleset, 2807.Xr pfctl 8 2808can load rulesets into 2809.Ar anchor 2810attachment points. 2811An 2812.Ar anchor 2813is a container that can hold rules, address tables, and other anchors. 2814.Pp 2815An 2816.Ar anchor 2817has a name which specifies the path where 2818.Xr pfctl 8 2819can be used to access the anchor to perform operations on it, such as 2820attaching child anchors to it or loading rules into it. 2821Anchors may be nested, with components separated by 2822.Sq / 2823characters, similar to how file system hierarchies are laid out. 2824The main ruleset is actually the default anchor, so filter and 2825translation rules, for example, may also be contained in any anchor. 2826.Pp 2827An anchor can reference another 2828.Ar anchor 2829attachment point 2830using the following kinds 2831of rules: 2832.Bl -tag -width xxxx 2833.It Ar nat-anchor Aq Ar name 2834Evaluates the 2835.Ar nat 2836rules in the specified 2837.Ar anchor . 2838.It Ar rdr-anchor Aq Ar name 2839Evaluates the 2840.Ar rdr 2841rules in the specified 2842.Ar anchor . 2843.It Ar binat-anchor Aq Ar name 2844Evaluates the 2845.Ar binat 2846rules in the specified 2847.Ar anchor . 2848.It Ar anchor Aq Ar name 2849Evaluates the filter rules in the specified 2850.Ar anchor . 2851.It Xo Ar load anchor 2852.Aq Ar name 2853.Ar from Aq Ar file 2854.Xc 2855Loads the rules from the specified file into the 2856anchor 2857.Ar name . 2858.El 2859.Pp 2860When evaluation of the main ruleset reaches an 2861.Ar anchor 2862rule, 2863.Xr pf 4 2864will proceed to evaluate all rules specified in that anchor. 2865.Pp 2866Matching filter and translation rules marked with the 2867.Ar quick 2868option are final and abort the evaluation of the rules in other 2869anchors and the main ruleset. 2870If the 2871.Ar anchor 2872itself is marked with the 2873.Ar quick 2874option, 2875ruleset evaluation will terminate when the anchor is exited if the packet is 2876matched by any rule within the anchor. 2877.Pp 2878.Ar anchor 2879rules are evaluated relative to the anchor in which they are contained. 2880For example, all 2881.Ar anchor 2882rules specified in the main ruleset will reference anchor 2883attachment points underneath the main ruleset, and 2884.Ar anchor 2885rules specified in a file loaded from a 2886.Ar load anchor 2887rule will be attached under that anchor point. 2888.Pp 2889Rules may be contained in 2890.Ar anchor 2891attachment points which do not contain any rules when the main ruleset 2892is loaded, and later such anchors can be manipulated through 2893.Xr pfctl 8 2894without reloading the main ruleset or other anchors. 2895For example, 2896.Bd -literal -offset indent 2897ext_if = \&"kue0\&" 2898block on $ext_if all 2899anchor spam 2900pass out on $ext_if all 2901pass in on $ext_if proto tcp from any \e 2902 to $ext_if port smtp 2903.Ed 2904.Pp 2905blocks all packets on the external interface by default, then evaluates 2906all rules in the 2907.Ar anchor 2908named "spam", and finally passes all outgoing connections and 2909incoming connections to port 25. 2910.Bd -literal -offset indent 2911# echo \&"block in quick from 1.2.3.4 to any\&" \&| \e 2912 pfctl -a spam -f - 2913.Ed 2914.Pp 2915This loads a single rule into the 2916.Ar anchor , 2917which blocks all packets from a specific address. 2918.Pp 2919The anchor can also be populated by adding a 2920.Ar load anchor 2921rule after the 2922.Ar anchor 2923rule: 2924.Bd -literal -offset indent 2925anchor spam 2926load anchor spam from "/etc/pf-spam.conf" 2927.Ed 2928.Pp 2929When 2930.Xr pfctl 8 2931loads 2932.Nm pf.conf , 2933it will also load all the rules from the file 2934.Pa /etc/pf-spam.conf 2935into the anchor. 2936.Pp 2937Optionally, 2938.Ar anchor 2939rules can specify packet filtering parameters using the same syntax as 2940filter rules. 2941When parameters are used, the 2942.Ar anchor 2943rule is only evaluated for matching packets. 2944This allows conditional evaluation of anchors, like: 2945.Bd -literal -offset indent 2946block on $ext_if all 2947anchor spam proto tcp from any to any port smtp 2948pass out on $ext_if all 2949pass in on $ext_if proto tcp from any to $ext_if port smtp 2950.Ed 2951.Pp 2952The rules inside 2953.Ar anchor 2954spam are only evaluated for 2955.Ar tcp 2956packets with destination port 25. 2957Hence, 2958.Bd -literal -offset indent 2959# echo \&"block in quick from 1.2.3.4 to any" \&| \e 2960 pfctl -a spam -f - 2961.Ed 2962.Pp 2963will only block connections from 1.2.3.4 to port 25. 2964.Pp 2965Anchors may end with the asterisk 2966.Pq Sq * 2967character, which signifies that all anchors attached at that point 2968should be evaluated in the alphabetical ordering of their anchor name. 2969For example, 2970.Bd -literal -offset indent 2971anchor "spam/*" 2972.Ed 2973.Pp 2974will evaluate each rule in each anchor attached to the 2975.Li spam 2976anchor. 2977Note that it will only evaluate anchors that are directly attached to the 2978.Li spam 2979anchor, and will not descend to evaluate anchors recursively. 2980.Pp 2981Since anchors are evaluated relative to the anchor in which they are 2982contained, there is a mechanism for accessing the parent and ancestor 2983anchors of a given anchor. 2984Similar to file system path name resolution, if the sequence 2985.Dq .. 2986appears as an anchor path component, the parent anchor of the current 2987anchor in the path evaluation at that point will become the new current 2988anchor. 2989As an example, consider the following: 2990.Bd -literal -offset indent 2991# echo ' anchor "spam/allowed" ' | pfctl -f - 2992# echo -e ' anchor "../banned" \en pass' | \e 2993 pfctl -a spam/allowed -f - 2994.Ed 2995.Pp 2996Evaluation of the main ruleset will lead into the 2997.Li spam/allowed 2998anchor, which will evaluate the rules in the 2999.Li spam/banned 3000anchor, if any, before finally evaluating the 3001.Ar pass 3002rule. 3003.Pp 3004Filter rule 3005.Ar anchors 3006can also be loaded inline in the ruleset within a brace ('{' '}') delimited 3007block. 3008Brace delimited blocks may contain rules or other brace-delimited blocks. 3009When anchors are loaded this way the anchor name becomes optional. 3010.Bd -literal -offset indent 3011anchor "external" on $ext_if { 3012 block 3013 anchor out { 3014 pass proto tcp from any to port { 25, 80, 443 } 3015 } 3016 pass in proto tcp to any port 22 3017} 3018.Ed 3019.Pp 3020Since the parser specification for anchor names is a string, any 3021reference to an anchor name containing 3022.Sq / 3023characters will require double quote 3024.Pq Sq \&" 3025characters around the anchor name. 3026.Sh SCTP CONSIDERATIONS 3027.Xr pf 4 3028supports 3029.Xr sctp 4 3030connections. 3031It can match ports, track state and NAT SCTP traffic. 3032However, it will not alter port numbers during nat or rdr translations. 3033Doing so would break SCTP multihoming. 3034.Sh TRANSLATION EXAMPLES 3035This example maps incoming requests on port 80 to port 8080, on 3036which a daemon is running (because, for example, it is not run as root, 3037and therefore lacks permission to bind to port 80). 3038.Bd -literal 3039# use a macro for the interface name, so it can be changed easily 3040ext_if = \&"ne3\&" 3041 3042# map daemon on 8080 to appear to be on 80 3043rdr on $ext_if proto tcp from any to any port 80 -\*(Gt 127.0.0.1 port 8080 3044.Ed 3045.Pp 3046If the 3047.Ar pass 3048modifier is given, packets matching the translation rule are passed without 3049inspecting the filter rules: 3050.Bd -literal 3051rdr pass on $ext_if proto tcp from any to any port 80 -\*(Gt 127.0.0.1 \e 3052 port 8080 3053.Ed 3054.Pp 3055In the example below, vlan12 is configured as 192.168.168.1; 3056the machine translates all packets coming from 192.168.168.0/24 to 204.92.77.111 3057when they are going out any interface except vlan12. 3058This has the net effect of making traffic from the 192.168.168.0/24 3059network appear as though it is the Internet routable address 3060204.92.77.111 to nodes behind any interface on the router except 3061for the nodes on vlan12. 3062(Thus, 192.168.168.1 can talk to the 192.168.168.0/24 nodes.) 3063.Bd -literal 3064nat on ! vlan12 from 192.168.168.0/24 to any -\*(Gt 204.92.77.111 3065.Ed 3066.Pp 3067In the example below, the machine sits between a fake internal 144.19.74.* 3068network, and a routable external IP of 204.92.77.100. 3069The 3070.Ar no nat 3071rule excludes protocol AH from being translated. 3072.Bd -literal 3073# NO NAT 3074no nat on $ext_if proto ah from 144.19.74.0/24 to any 3075nat on $ext_if from 144.19.74.0/24 to any -\*(Gt 204.92.77.100 3076.Ed 3077.Pp 3078In the example below, packets bound for one specific server, as well as those 3079generated by the sysadmins are not proxied; all other connections are. 3080.Bd -literal 3081# NO RDR 3082no rdr on $int_if proto { tcp, udp } from any to $server port 80 3083no rdr on $int_if proto { tcp, udp } from $sysadmins to any port 80 3084rdr on $int_if proto { tcp, udp } from any to any port 80 -\*(Gt 127.0.0.1 \e 3085 port 80 3086.Ed 3087.Pp 3088This longer example uses both a NAT and a redirection. 3089The external interface has the address 157.161.48.183. 3090On localhost, we are running 3091.Xr ftp-proxy 8 , 3092waiting for FTP sessions to be redirected to it. 3093The three mandatory anchors for 3094.Xr ftp-proxy 8 3095are omitted from this example; see the 3096.Xr ftp-proxy 8 3097manpage. 3098.Bd -literal 3099# NAT 3100# Translate outgoing packets' source addresses (any protocol). 3101# In this case, any address but the gateway's external address is mapped. 3102nat on $ext_if inet from ! ($ext_if) to any -\*(Gt ($ext_if) 3103 3104# NAT PROXYING 3105# Map outgoing packets' source port to an assigned proxy port instead of 3106# an arbitrary port. 3107# In this case, proxy outgoing isakmp with port 500 on the gateway. 3108nat on $ext_if inet proto udp from any port = isakmp to any -\*(Gt ($ext_if) \e 3109 port 500 3110 3111# BINAT 3112# Translate outgoing packets' source address (any protocol). 3113# Translate incoming packets' destination address to an internal machine 3114# (bidirectional). 3115binat on $ext_if from 10.1.2.150 to any -\*(Gt $ext_if 3116 3117# Translate packets arriving on $peer_if addressed to 172.22.16.0/20 3118# to the corresponding address in 172.21.16.0/20 (bidirectional). 3119binat on $peer_if from 172.21.16.0/20 to any -> 172.22.16.0/20 3120 3121# RDR 3122# Translate incoming packets' destination addresses. 3123# As an example, redirect a TCP and UDP port to an internal machine. 3124rdr on $ext_if inet proto tcp from any to ($ext_if) port 8080 \e 3125 -\*(Gt 10.1.2.151 port 22 3126rdr on $ext_if inet proto udp from any to ($ext_if) port 8080 \e 3127 -\*(Gt 10.1.2.151 port 53 3128 3129# RDR 3130# Translate outgoing ftp control connections to send them to localhost 3131# for proxying with ftp-proxy(8) running on port 8021. 3132rdr on $int_if proto tcp from any to any port 21 -\*(Gt 127.0.0.1 port 8021 3133.Ed 3134.Pp 3135In this example, a NAT gateway is set up to translate internal addresses 3136using a pool of public addresses (192.0.2.16/28) and to redirect 3137incoming web server connections to a group of web servers on the internal 3138network. 3139.Bd -literal 3140# NAT LOAD BALANCE 3141# Translate outgoing packets' source addresses using an address pool. 3142# A given source address is always translated to the same pool address by 3143# using the source-hash keyword. 3144nat on $ext_if inet from any to any -\*(Gt 192.0.2.16/28 source-hash 3145 3146# RDR ROUND ROBIN 3147# Translate incoming web server connections to a group of web servers on 3148# the internal network. 3149rdr on $ext_if proto tcp from any to any port 80 \e 3150 -\*(Gt { 10.1.2.155, 10.1.2.160, 10.1.2.161 } round-robin 3151.Ed 3152.Sh FILTER EXAMPLES 3153.Bd -literal 3154# The external interface is kue0 3155# (157.161.48.183, the only routable address) 3156# and the private network is 10.0.0.0/8, for which we are doing NAT. 3157 3158# Reassemble incoming traffic 3159set reassemble yes 3160 3161# use a macro for the interface name, so it can be changed easily 3162ext_if = \&"kue0\&" 3163 3164# block and log everything by default 3165block return log on $ext_if all 3166 3167# block anything coming from source we have no back routes for 3168block in from no-route to any 3169 3170# block packets whose ingress interface does not match the one in 3171# the route back to their source address 3172block in from urpf-failed to any 3173 3174# block and log outgoing packets that do not have our address as source, 3175# they are either spoofed or something is misconfigured (NAT disabled, 3176# for instance), we want to be nice and do not send out garbage. 3177block out log quick on $ext_if from ! 157.161.48.183 to any 3178 3179# silently drop broadcasts (cable modem noise) 3180block in quick on $ext_if from any to 255.255.255.255 3181 3182# block and log incoming packets from reserved address space and invalid 3183# addresses, they are either spoofed or misconfigured, we cannot reply to 3184# them anyway (hence, no return-rst). 3185block in log quick on $ext_if from { 10.0.0.0/8, 172.16.0.0/12, \e 3186 192.168.0.0/16, 255.255.255.255/32 } to any 3187 3188# ICMP 3189 3190# pass out/in certain ICMP queries and keep state (ping) 3191# state matching is done on host addresses and ICMP id (not type/code), 3192# so replies (like 0/0 for 8/0) will match queries 3193# ICMP error messages (which always refer to a TCP/UDP packet) are 3194# handled by the TCP/UDP states 3195pass on $ext_if inet proto icmp all icmp-type 8 code 0 3196 3197# UDP 3198 3199# pass out all UDP connections and keep state 3200pass out on $ext_if proto udp all 3201 3202# pass in certain UDP connections and keep state (DNS) 3203pass in on $ext_if proto udp from any to any port domain 3204 3205# TCP 3206 3207# pass out all TCP connections and modulate state 3208pass out on $ext_if proto tcp all modulate state 3209 3210# pass in certain TCP connections and keep state (SSH, SMTP, DNS, IDENT) 3211pass in on $ext_if proto tcp from any to any port { ssh, smtp, domain, \e 3212 auth } 3213 3214# Do not allow Windows 9x SMTP connections since they are typically 3215# a viral worm. Alternately we could limit these OSes to 1 connection each. 3216block in on $ext_if proto tcp from any os {"Windows 95", "Windows 98"} \e 3217 to any port smtp 3218 3219# IPv6 3220# pass in/out all IPv6 traffic: note that we have to enable this in two 3221# different ways, on both our physical interface and our tunnel 3222pass quick on gif0 inet6 3223pass quick on $ext_if proto ipv6 3224 3225# Packet Tagging 3226 3227# three interfaces: $int_if, $ext_if, and $wifi_if (wireless). NAT is 3228# being done on $ext_if for all outgoing packets. tag packets in on 3229# $int_if and pass those tagged packets out on $ext_if. all other 3230# outgoing packets (i.e., packets from the wireless network) are only 3231# permitted to access port 80. 3232 3233pass in on $int_if from any to any tag INTNET 3234pass in on $wifi_if from any to any 3235 3236block out on $ext_if from any to any 3237pass out quick on $ext_if tagged INTNET 3238pass out on $ext_if proto tcp from any to any port 80 3239 3240# tag incoming packets as they are redirected to spamd(8). use the tag 3241# to pass those packets through the packet filter. 3242 3243rdr on $ext_if inet proto tcp from \*(Ltspammers\*(Gt to port smtp \e 3244 tag SPAMD -\*(Gt 127.0.0.1 port spamd 3245 3246block in on $ext_if 3247pass in on $ext_if inet proto tcp tagged SPAMD 3248.Ed 3249.Pp 3250In the example below, a router handling both address families 3251translates an internal IPv4 subnet to IPv6 using the well-known 325264:ff9b::/96 prefix: 3253.Bd -literal -offset 4n 3254pass in on $v4_if inet af-to inet6 from ($v6_if) to 64:ff9b::/96 3255.Ed 3256.Pp 3257Paired with the example above, the example below can be used on 3258another router handling both address families to translate back 3259to IPv4: 3260.Bd -literal -offset 4n 3261pass in on $v6_if inet6 to 64:ff9b::/96 af-to inet from ($v4_if) 3262.Ed 3263.Sh GRAMMAR 3264Syntax for 3265.Nm 3266in BNF: 3267.Bd -literal 3268line = ( option | ether-rule | pf-rule | nat-rule | binat-rule | 3269 rdr-rule | antispoof-rule | altq-rule | queue-rule | 3270 trans-anchors | anchor-rule | anchor-close | load-anchor | 3271 table-rule | include ) 3272 3273option = "set" ( [ "timeout" ( timeout | "{" timeout-list "}" ) ] | 3274 [ "ruleset-optimization" [ "none" | "basic" | "profile" ]] | 3275 [ "optimization" [ "default" | "normal" | 3276 "high-latency" | "satellite" | 3277 "aggressive" | "conservative" ] ] 3278 [ "limit" ( limit-item | "{" limit-list "}" ) ] | 3279 [ "loginterface" ( interface-name | "none" ) ] | 3280 [ "block-policy" ( "drop" | "return" ) ] | 3281 [ "state-policy" ( "if-bound" | "floating" ) ] 3282 [ "state-defaults" state-opts ] 3283 [ "require-order" ( "yes" | "no" ) ] 3284 [ "fingerprints" filename ] | 3285 [ "skip on" ifspec ] | 3286 [ "debug" ( "none" | "urgent" | "misc" | "loud" ) ] 3287 [ "keepcounters" ] ) 3288 3289ether-rule = "ether" etheraction [ ( "in" | "out" ) ] 3290 [ "quick" ] [ "on" ifspec ] [ "bridge-to" interface-name ] 3291 [ etherprotospec ] etherhosts [ "l3" hosts ] 3292 [ etherfilteropt-list ] 3293 3294pf-rule = action [ ( "in" | "out" ) ] 3295 [ "log" [ "(" logopts ")"] ] [ "quick" ] 3296 [ "on" ifspec ] [ route ] [ af ] [ protospec ] 3297 hosts [ filteropt-list ] 3298 3299logopts = logopt [ "," logopts ] 3300logopt = "all" | "matches" | "user" | "to" interface-name 3301 3302etherfilteropt-list = etherfilteropt-list etherfilteropt | etherfilteropt 3303etherfilteropt = "tag" string | "tagged" string | "queue" ( string ) | 3304 "ridentifier" number | "label" string 3305 3306filteropt-list = filteropt-list filteropt | filteropt 3307filteropt = user | group | flags | icmp-type | icmp6-type | "tos" tos | 3308 "af-to" af "from" ( redirhost | "{" redirhost-list "}" ) 3309 [ "to" ( redirhost | "{" redirhost-list "}" ) ] | 3310 ( "no" | "keep" | "modulate" | "synproxy" ) "state" 3311 [ "(" state-opts ")" ] | 3312 "fragment" | "no-df" | "min-ttl" number | "set-tos" tos | 3313 "max-mss" number | "random-id" | "reassemble tcp" | 3314 fragmentation | "allow-opts" | 3315 "label" string | "tag" string | [ ! ] "tagged" string | 3316 "set prio" ( number | "(" number [ [ "," ] number ] ")" ) | 3317 "queue" ( string | "(" string [ [ "," ] string ] ")" ) | 3318 "rtable" number | "probability" number"%" | "prio" number | 3319 "dnpipe" ( number | "(" number "," number ")" ) | 3320 "dnqueue" ( number | "(" number "," number ")" ) | 3321 "ridentifier" number | 3322 "received-on" ( interface-name | interface-group ) 3323 3324nat-rule = [ "no" ] "nat" [ "pass" [ "log" [ "(" logopts ")" ] ] ] 3325 [ "on" ifspec ] [ af ] 3326 [ protospec ] hosts [ "tag" string ] [ "tagged" string ] 3327 [ "-\*(Gt" ( redirhost | "{" redirhost-list "}" ) 3328 [ portspec ] [ pooltype ] [ "static-port" ] 3329 [ "map-e-portset" number "/" number "/" number ] ] 3330 3331binat-rule = [ "no" ] "binat" [ "pass" [ "log" [ "(" logopts ")" ] ] ] 3332 [ "on" interface-name ] [ af ] 3333 [ "proto" ( proto-name | proto-number ) ] 3334 "from" address [ "/" mask-bits ] "to" ipspec 3335 [ "tag" string ] [ "tagged" string ] 3336 [ "-\*(Gt" address [ "/" mask-bits ] ] 3337 3338rdr-rule = [ "no" ] "rdr" [ "pass" [ "log" [ "(" logopts ")" ] ] ] 3339 [ "on" ifspec ] [ af ] 3340 [ protospec ] hosts [ "tag" string ] [ "tagged" string ] 3341 [ "-\*(Gt" ( redirhost | "{" redirhost-list "}" ) 3342 [ portspec ] [ pooltype ] ] 3343 3344antispoof-rule = "antispoof" [ "log" ] [ "quick" ] 3345 "for" ifspec [ af ] [ "label" string ] 3346 [ "ridentifier" number ] 3347 3348table-rule = "table" "\*(Lt" string "\*(Gt" [ tableopts-list ] 3349tableopts-list = tableopts-list tableopts | tableopts 3350tableopts = "persist" | "const" | "counters" | "file" string | 3351 "{" [ tableaddr-list ] "}" 3352tableaddr-list = tableaddr-list [ "," ] tableaddr-spec | tableaddr-spec 3353tableaddr-spec = [ "!" ] tableaddr [ "/" mask-bits ] 3354tableaddr = hostname | ifspec | "self" | 3355 ipv4-dotted-quad | ipv6-coloned-hex 3356 3357altq-rule = "altq on" interface-name queueopts-list 3358 "queue" subqueue 3359queue-rule = "queue" string [ "on" interface-name ] queueopts-list 3360 subqueue 3361 3362anchor-rule = "anchor" [ string ] [ ( "in" | "out" ) ] [ "on" ifspec ] 3363 [ af ] [ protospec ] [ hosts ] [ filteropt-list ] [ "{" ] 3364 3365anchor-close = "}" 3366 3367trans-anchors = ( "nat-anchor" | "rdr-anchor" | "binat-anchor" ) string 3368 [ "on" ifspec ] [ af ] [ "proto" ] [ protospec ] [ hosts ] 3369 3370load-anchor = "load anchor" string "from" filename 3371 3372queueopts-list = queueopts-list queueopts | queueopts 3373queueopts = [ "bandwidth" bandwidth-spec ] | 3374 [ "qlimit" number ] | [ "tbrsize" number ] | 3375 [ "priority" number ] | [ schedulers ] 3376schedulers = ( cbq-def | priq-def | hfsc-def ) 3377bandwidth-spec = "number" ( "b" | "Kb" | "Mb" | "Gb" | "%" ) 3378 3379etheraction = "pass" | "block" 3380action = "pass" | "match" | "block" [ return ] | [ "no" ] "scrub" 3381return = "drop" | "return" | "return-rst" [ "( ttl" number ")" ] | 3382 "return-icmp" [ "(" icmpcode [ [ "," ] icmp6code ] ")" ] | 3383 "return-icmp6" [ "(" icmp6code ")" ] 3384icmpcode = ( icmp-code-name | icmp-code-number ) 3385icmp6code = ( icmp6-code-name | icmp6-code-number ) 3386 3387ifspec = ( [ "!" ] ( interface-name | interface-group ) ) | 3388 "{" interface-list "}" 3389interface-list = [ "!" ] ( interface-name | interface-group ) 3390 [ [ "," ] interface-list ] 3391route = ( "route-to" | "reply-to" | "dup-to" ) 3392 ( routehost | "{" routehost-list "}" ) 3393 [ pooltype ] 3394af = "inet" | "inet6" 3395 3396etherprotospec = "proto" ( proto-number | "{" etherproto-list "}" ) 3397etherproto-list = proto-number [ [ "," ] etherproto-list ] 3398protospec = "proto" ( proto-name | proto-number | 3399 "{" proto-list "}" ) 3400proto-list = ( proto-name | proto-number ) [ [ "," ] proto-list ] 3401 3402etherhosts = "from" macaddress "to" macaddress 3403macaddress = mac | mac "/" masklen | mac "&" mask 3404 3405hosts = "all" | 3406 "from" ( "any" | "no-route" | "urpf-failed" | "self" | host | 3407 "{" host-list "}" ) [ port ] [ os ] 3408 "to" ( "any" | "no-route" | "self" | host | 3409 "{" host-list "}" ) [ port ] 3410 3411ipspec = "any" | host | "{" host-list "}" 3412host = [ "!" ] ( address [ "/" mask-bits ] | "\*(Lt" string "\*(Gt" ) 3413redirhost = address [ "/" mask-bits ] 3414routehost = "(" interface-name [ address [ "/" mask-bits ] ] ")" 3415address = ( interface-name | interface-group | 3416 "(" ( interface-name | interface-group ) ")" | 3417 hostname | ipv4-dotted-quad | ipv6-coloned-hex ) 3418host-list = host [ [ "," ] host-list ] 3419redirhost-list = redirhost [ [ "," ] redirhost-list ] 3420routehost-list = routehost [ [ "," ] routehost-list ] 3421 3422port = "port" ( unary-op | binary-op | "{" op-list "}" ) 3423portspec = "port" ( number | name ) [ ":" ( "*" | number | name ) ] 3424os = "os" ( os-name | "{" os-list "}" ) 3425user = "user" ( unary-op | binary-op | "{" op-list "}" ) 3426group = "group" ( unary-op | binary-op | "{" op-list "}" ) 3427 3428unary-op = [ "=" | "!=" | "\*(Lt" | "\*(Le" | "\*(Gt" | "\*(Ge" ] 3429 ( name | number ) 3430binary-op = number ( "\*(Lt\*(Gt" | "\*(Gt\*(Lt" | ":" ) number 3431op-list = ( unary-op | binary-op ) [ [ "," ] op-list ] 3432 3433os-name = operating-system-name 3434os-list = os-name [ [ "," ] os-list ] 3435 3436flags = "flags" ( [ flag-set ] "/" flag-set | "any" ) 3437flag-set = [ "F" ] [ "S" ] [ "R" ] [ "P" ] [ "A" ] [ "U" ] [ "E" ] 3438 [ "W" ] 3439 3440icmp-type = "icmp-type" ( icmp-type-code | "{" icmp-list "}" ) 3441icmp6-type = "icmp6-type" ( icmp-type-code | "{" icmp-list "}" ) 3442icmp-type-code = ( icmp-type-name | icmp-type-number ) 3443 [ "code" ( icmp-code-name | icmp-code-number ) ] 3444icmp-list = icmp-type-code [ [ "," ] icmp-list ] 3445 3446tos = ( "lowdelay" | "throughput" | "reliability" | 3447 [ "0x" ] number ) 3448 3449state-opts = state-opt [ [ "," ] state-opts ] 3450state-opt = ( "max" number | "no-sync" | timeout | "sloppy" | 3451 "source-track" [ ( "rule" | "global" ) ] | 3452 "max-src-nodes" number | "max-src-states" number | 3453 "max-src-conn" number | 3454 "max-src-conn-rate" number "/" number | 3455 "overload" "\*(Lt" string "\*(Gt" [ "flush" ] | 3456 "if-bound" | "floating" | "pflow" ) 3457 3458fragmentation = [ "fragment reassemble" ] 3459 3460timeout-list = timeout [ [ "," ] timeout-list ] 3461timeout = ( "tcp.first" | "tcp.opening" | "tcp.established" | 3462 "tcp.closing" | "tcp.finwait" | "tcp.closed" | 3463 "sctp.first" | "sctp.opening" | "sctp.established" | 3464 "sctp.closing" | "sctp.closed" | 3465 "udp.first" | "udp.single" | "udp.multiple" | 3466 "icmp.first" | "icmp.error" | 3467 "other.first" | "other.single" | "other.multiple" | 3468 "frag" | "interval" | "src.track" | 3469 "adaptive.start" | "adaptive.end" ) number 3470 3471limit-list = limit-item [ [ "," ] limit-list ] 3472limit-item = ( "states" | "frags" | "src-nodes" ) number 3473 3474pooltype = ( "bitmask" | "random" | 3475 "source-hash" [ ( hex-key | string-key ) ] | 3476 "round-robin" ) [ sticky-address ] 3477 3478subqueue = string | "{" queue-list "}" 3479queue-list = string [ [ "," ] string ] 3480cbq-def = "cbq" [ "(" cbq-opt [ [ "," ] cbq-opt ] ")" ] 3481priq-def = "priq" [ "(" priq-opt [ [ "," ] priq-opt ] ")" ] 3482hfsc-def = "hfsc" [ "(" hfsc-opt [ [ "," ] hfsc-opt ] ")" ] 3483cbq-opt = ( "default" | "borrow" | "red" | "ecn" | "rio" ) 3484priq-opt = ( "default" | "red" | "ecn" | "rio" ) 3485hfsc-opt = ( "default" | "red" | "ecn" | "rio" | 3486 linkshare-sc | realtime-sc | upperlimit-sc ) 3487linkshare-sc = "linkshare" sc-spec 3488realtime-sc = "realtime" sc-spec 3489upperlimit-sc = "upperlimit" sc-spec 3490sc-spec = ( bandwidth-spec | 3491 "(" bandwidth-spec number bandwidth-spec ")" ) 3492include = "include" filename 3493.Ed 3494.Sh FILES 3495.Bl -tag -width "/etc/protocols" -compact 3496.It Pa /etc/hosts 3497Host name database. 3498.It Pa /etc/pf.conf 3499Default location of the ruleset file. 3500The file has to be created manually as it is not installed with a 3501standard installation. 3502.It Pa /etc/pf.os 3503Default location of OS fingerprints. 3504.It Pa /etc/protocols 3505Protocol name database. 3506.It Pa /etc/services 3507Service name database. 3508.El 3509.Sh SEE ALSO 3510.Xr altq 4 , 3511.Xr carp 4 , 3512.Xr icmp 4 , 3513.Xr icmp6 4 , 3514.Xr ip 4 , 3515.Xr ip6 4 , 3516.Xr pf 4 , 3517.Xr pflow 4 , 3518.Xr pfsync 4 , 3519.Xr sctp 4 , 3520.Xr tcp 4 , 3521.Xr udp 4 , 3522.Xr hosts 5 , 3523.Xr pf.os 5 , 3524.Xr protocols 5 , 3525.Xr services 5 , 3526.Xr ftp-proxy 8 , 3527.Xr pfctl 8 , 3528.Xr pflogd 8 3529.Sh HISTORY 3530The 3531.Nm 3532file format first appeared in 3533.Ox 3.0 . 3534