Polarwave's OpenBSD
Tips and Tricks for Newbies

| PF |

PF

Setup For Single Box

Between what I've studied on the OpenBSD PF FAQ pages , in Jacek Artimiak's
book, Building Firewalls with OpenBSD and PF, Second Edition which I highly
recommend, in the pertinent man pages pf(4) and pf.conf(5) , and in what I've
found using search engines and reading on the OpenBSD mailing lists, I managed
to put together a rudimentary firewall for my OpenBSD box. I wanted to tighten
it down fairly well by default, then selectively choose exactly what I wanted to let
in. I had a fairly rough time of it, searching on the internet for an example that
was close to what I needed, probably because I'm not the world's greatest searcher.
There are those purists who would say it's not right to put up too detailed of examples,
that folks need to learn on their own, but I found using some of the examples I found
and watching how they worked actually helped me. That being said, right or wrong,
I'm putting up an example of what I came up with. Here's what the firewall attempts
to accomplish:

• It sets the macros for my network card which is fxp0, two other boxes on my
  network grouped together for a single purpose later, along with one just for
  the windows box for another purpose later.
• The tables section defines bruteforce which is explained further down the page.
• • The options section enforces ordering of statement types.
    
  • It sets the block policy to silently drop packets.
    
  • It sets network optimization to normal which works for almost all systems
    without any special needs.
    
  • It sets loginterface to none since I've no special need to read that much log
    info, right now, anyway.
    
  • It skips filtering on localhost which can lead to unexpected effects.
    
    
• Normalization is set to scrub all, both incoming and outgoing. The less paranoid
  say on incoming is enough.
  
• Filters blocks in all by default with what we need being selected later. Also all
  blocked packets are logged.
  
• It blocks return-icmp which is safe and also considered good net etiquette, since
  it helps services like sendmail to complete faster, since they don't have to wait for
  connections to port 113 to time out.
• It blocks brute force attackers. More in ssh section further on.
• Operating system fingerprinting watches for external Linux boxes trying to connect.
  Many people say the majority of "zombie" boxes trying to gain access to their
  networks are Linux based.
  
• Pass out quick on the network interface to any is, in some people's view, a rather
  liberal setting. It can be tightened down a lot more, but in my case, I'm usually the
  only user, so I'm living dangerously. :-)
  
• It passes all ssh incoming requests which seems a bit strange in light of some of the
  other settings, but I've done it in preparation for later when I'll be logging in from
  a remote location. It's tightened down after getting past pf with /etc/hosts.deny,
  /etc/hosts.allow, and the ssh config files. max-src-conn & max-src-conn-rate
  are tight and the brute force setting watches for anyone repeatedly trying to get in
  and failing. They'll be entered into a table and won't get many chances before they're
  completely blocked, which also saves a of logging.
  
• It allows the box to act as a time server for the local area network. Trusted boxes are
  allowed ntpd access.
  
• It allows a Windows box on the local area network access via samba shares.
  
• It uses antispoofing to prevent source address spoofing.
  

# $OpenBSD: pf.conf,v 1.34 2007/02/24 19:30:59 millert Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.

# Macros
# interface to the outside world
ext_if="fxp0"
# trusted hosts on local area network
trusted = "{LAN Box IP address, LAN Box IP address}"
# just the windoze box on local area network
windoze = "{LAN Box IP address}"

# Tables
table <bruteforce> persist
# Added the following to Tables after running into problems with local
# boxes getting blocked when accessing this box too often, too quickly.
# They were getting caught by the bruteforce protection.
table <friends> persist { LAN Box IP address, LAN Box IP address}"

# Options
set require-order yes
set block-policy drop
set optimization normal
set loginterface none
set skip on lo0

# Normalize packets
scrub in all
scrub out all

# Filter packets
# block all incoming connections sent from the outside
# log all blocked packets

block in log all

# Block all inbound connections to port 113 (auth)
# Return ICMP destination-unreachable

block return-icmp in quick on $ext_if proto tcp \
 from any to $ext_if port auth

# Block brute force attackers

block quick from <bruteforce>

# OS fingerprinting to block external linux zombie boxes
block log quick on $ext_if proto tcp from any os "Linux" to port 22

# Pass out all connections sent from the host

pass out quick on $ext_if inet \
 from ($ext_if) to any flags S/SA keep state

# Pass all connections originating from external
# hosts to port 22 (SSH) on this host.
# Waste some time for the Brute Forcers.
# Then trash 'em!

pass inet proto tcp from any to $ext_if port 22 \
 flags S/SA keep state \
 (max-src-conn 3, max-src-conn-rate 3/30, \
 overload <bruteforce> flush global)

#Added the following to work with the friends entry in Tables.
pass inet proto tcp from <friends> to $ext_if port 22 \
 flags S/SA keep state \

# pass ntpd calls from local area network boxes

pass inet proto udp \
 from $trusted to $ext_if port 123 \
 keep state

# Pass all from LAN windows box to Samba.
# Ports 137, 138, 139, and 445.

pass inet proto tcp \
 from $windoze \
 to $ext_if port {137:139,445} \
 flags S/SA keep state

# antispoof rule on the external interface
antispoof for $ext_if

Bear in mind that I'm really just getting started with pf. If you see something you think
is wrong, could be improved on, or have a question, email me from the Contact Page or
leave a comment on the Blog Page and I'll get back to you on it, make changes on this
page, or take care of whatever it is. Hope this helps anyone looking to explore security
with pf.

Back to Tips and Tricks
Home

Bookmark this on Delicious