Building the Network You Need with OpenBSD's PF

BSDCan, Ottawa May 11th, 2010

Peter N. M. Hansteen

BSDly.net

peter@bsdly.net

Table of Contents
This is not a HOWTO
You're wondering ...
You're wondering ... Linux?
You're wondering ... Learn BSD?
You're wondering ... GUI tools?
You're wondering ... Automatic conversion?
You're wondering ... More info?
PF - Haiku
What PF is
Packet filter? Firewall?
NAT?
PF today
Simplest possible setup
Simplest possible setup (FreeBSD)
Simplest possible setup (NetBSD)
First rule set - single machine
Testing your first rule set
Slightly stricter
Testing your rule set
Statistics from pfctl
A gateway
Pitfalls: in, out, on
Keep it simple: What is your local network, anyway?
Simple gateway (with NAT if you need to)
Simple gateway with NAT (cont'd.)
Simple gateway with NAT: 4.7 and newer
OpenBSD 4.6 Alert: match rules
Simple gateway with NAT: pre-4.7 version
Simple gateway with NAT
Testing your rule set
Domain names and host names?
VPNs and tunneling
VPNs: the enc interface
VPNs: key exchange, misc
That old and sad FTP thing
If we have to: ftp-proxy with redirection
ftp-proxy, pre-4.7
Tables make your life easier
Table commands
Filtering for services
Filtering for services (cont)
Giving spammers a hard time: you're not alone
Giving spammers a hard time (cont'd)
Greylisting: See the RFC
Greylisting: My admin told me not to talk to strangers
Giving spammers a hard time: The rules
Setting up spamd: spamd.conf
Setting up spamd - FreeBSD, NetBSD
Setting up spamd: rc.conf parameters
Track real SMTP connections: spamdlogd
Giving spammers a hard time (cont'd)
Giving spammers a hard time (cont'd)
Giving spammers a hard time (cont'd)
Connection lengths
Beating'em up some more: spamdb and greytrapping
spamdb and greytrapping
Greytrapping - the result
Keeping several spamds in sync
Some people really do not get it
Giving spammers a hard time: Conclusion
Turning away the brutes
Turning away the brutes: The rules
Turning away the brutes (cont'd)
Turning away the brutes (cont'd)
Expiring table entries with pfctl
Advanced state tracking
State tracking (cont)
Physical Separation: The DMZ
DMZ ruleset
DMZ ruleset: tighten
Anchors
Anchors: commands
Anchors: ruleset
Anchors: alternative structure
Anchors - tag and quick
Including files
Wireless networks: background
Wireless networks made easy
Wireless networks: WPA setup
Wireless networks made easy (cont'd)
Wireless networks made easy (cont'd)
authpf: per user rules
Basic authpf setup
Basic authpf setup (cont)
Basic authpf setup (cont)
Per user rules
Wide open but actually shut
Open but shut: pf.conf
authpf-noip (introduced in OpenBSD 4.3)
Sharing the load: Address pools
relayd, nee hoststated
Basic relayd config
Basic relayd config (cont)
Basic relayd config (cont)
relayctl
relayd for SSL load balancing
Relayd DSR support (4.4)
Filtering for services, the NAT version
Back to the single NATed network
Single NAT, web & mail server on the inside: from the inside
Single NAT, web & mail server on the inside: from the inside
Single NAT, web & mail server on the inside: from the inside
Filtering on interface groups
The power of tags
The filtering bridge
Where does it go?
OpenBSD bridge setup
FreeBSD bridge setup
Bridge PF filtering config
Handling non-routable addresses from elsewhere
Directing traffic with altq
Setting up for ALTQ
Setting up for ALTQ: FreeBSD
Setting up for ALTQ: NetBSD
What is your usable bandwidth?
ALTQ - prioritizing by traffic type
ALTQ: queue assignment with match rule
ALTQ: systat queues
ALTQ - allocation by percentage
A Basic HFSC Traffic Shaper
HFSC systat queues view
Queueing for a DMZ
Queueing for a DMZ: rules part 1
Queueing for a DMZ: rules part 2
Overloading to a tiny queue
ALTQ - handling unwanted traffic
CARP and pfsync
CARP: project spec
CARP: project spec cont'd
CARP: project spec cont'd
Is your system CARP ready?
Setting up CARP
CARP: ifconfig
pfsync
What happens to the rule set?
carp config example
Carp ruleset
Making your network troubleshooting friendly
Then, do we let it all through?
The easy way out: The buck stops here
Letting ping through
Helping traceroute
Path MTU discovery
Path MTU discovery (cont'd)
Logging
Taking a peek with tcpdump
tcpdump is your friend
Matching log data to your rule set
Log to syslog
Statistics via labels
$variable label names
$variable label names: example
Keeping an eye on things with systat states
Graph your traffic: pfstat
New in 4.5: pflow(4) and pflow state option
pflow in your rule set
pflow: config the interface
pflow: set up a collector
Other log tools you may want to look into
Good logs for good debugging
Getting your setup just right
block-policy
skip
state-policy
state-defaults (new in 4.5)
timeout
limit
debug
ruleset-optimiation
optimization
Hygiene: scrub and antispoof
scrub, the state option
Testing your setup
Specification (possibly incomplete)
Debugging your setup
Debugging some more
Debug - use tcpdump
Have fun!
If you enjoyed this: Support OpenBSD!
References