Go Back   DaemonForums > OpenBSD > OpenBSD Security

OpenBSD Security Functionally paranoid!

Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1   (View Single Post)  
Old 6th September 2013
inversebit inversebit is offline
New User
Join Date: Mar 2013
Posts: 2
Default Default pf ruleset at boot and PPPoE

I'm using kernel pppoe for my internet interface and my pf.conf contains the rules for the pppoe0 interface (amongst others), however on boot this ruleset is not loaded and a very restrictive default set is loaded instead:

block drop all
pass out inet6 proto ipv6-icmp all icmp6-type neighbrsol
pass out inet6 proto ipv6-icmp all icmp6-type routersol
pass out proto tcp from any to any port = 53 flags S/SA
pass out proto udp from any to any port = 53
pass out inet proto icmp all icmp-type echoreq
pass in inet6 proto ipv6-icmp all icmp6-type neighbradv
pass in inet6 proto ipv6-icmp all icmp6-type routeradv
pass in proto tcp from any to any port = 22 flags S/SA
pass on lo0 all flags S/SA
pass proto carp all keep state (no-sync)
No queue in use
The ppp interface comes up correctly at boot but I need to reload the rules manually from pf.conf to get things working - I assume my ruleset is not getting loaded as pf is started before the ppp interface is up and contains invalid rules at this point.

My questions are:

1) Is it possible to see the pf errors on boot, there seems to be nothing in the logs or console about pf not loading correctly.

2) Is it possible to change the default rules or would I need to define a restricted pf.conf and then load the full 'ppp' pf.conf once the interface is up? If so how would you recommend I load the rules once the interface is up - ifstated maybe?

Kernel pppoe to ISP seems like a common enough scenario but I can't find other reports of similar issues.

OpenBSD 5.2 GENERIC#278 i386
Reply With Quote

pf, ppp

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
pf ruleset for ftp server? daemonfowl OpenBSD Security 2 30th July 2012 02:58 PM
Help needed with PF ruleset spaghetti_bolognese OpenBSD Security 1 14th September 2010 11:37 AM
Free PF Ruleset 4.7 wesley OpenBSD Security 0 7th June 2010 06:18 AM
FTP ruleset questions hitete OpenBSD Security 2 25th November 2008 05:30 PM
Modem PPPoE vs OpenBSD PPPoE ryoken OpenBSD Security 13 15th June 2008 10:07 PM

All times are GMT. The time now is 01:09 AM.

Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2018, Jelsoft Enterprises Ltd.
Content copyright © 2007-2010, the authors
Daemon image copyright ©1988, Marshall Kirk McKusick