DaemonForums  

Go Back   DaemonForums > OpenBSD > OpenBSD Security

OpenBSD Security Functionally paranoid!

Reply
 
Thread Tools Display Modes
  #1   (View Single Post)  
Old 4 Weeks Ago
sputnik sputnik is offline
Port Guard
 
Join Date: Mar 2009
Posts: 25
Default PF block in / block in all

As the title suggests, i'm confused about the difference between the two. I don't get the 'all' keyword, unless it's used for direction (e.g. block all, for in and out). But what meaning does it have when used after the direction?
Reply With Quote
  #2   (View Single Post)  
Old 4 Weeks Ago
bsdun's Avatar
bsdun bsdun is offline
Real Name: Steve
Port Guard
 
Join Date: Feb 2020
Posts: 35
Default

block in, block out is used with list of addresses to block from.
Example:
Code:
martians = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, \
              10.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, \
              0.0.0.0/8, 240.0.0.0/4 }"
block in quick on $ext_if from $martians to any
block out quick on $ext_if from any to $martians
If you want to block inbound traffic from all addresses, you use block in all, if you want to allow outbound traffic to all addresses, you use pass out all.
Example:
Code:
block in all
pass out all keep state
Reply With Quote
  #3   (View Single Post)  
Old 4 Weeks Ago
sputnik sputnik is offline
Port Guard
 
Join Date: Mar 2009
Posts: 25
Default

Hmm, but they both do the same thing"
Code:
block in
pass out keep state
and
Code:
block in all
pass out all keep state
does exactly the same thing.
Reply With Quote
  #4   (View Single Post)  
Old 4 Weeks Ago
fvgit's Avatar
fvgit fvgit is offline
Spikes in tights
 
Join Date: May 2016
Location: perl -MMIME::Base64 -le 'print decode_base64("U2hlcndvb2QgRm9yZXN0")'
Posts: 270
Default

Quote:
Originally Posted by sputnik View Post
I don't get the 'all' keyword, unless it's used for direction (e.g. block all, for in and out). But what meaning does it have when used after the direction?
Straight from the manpage pf.conf(5):
Code:
     all     This is equivalent to ‘from any to any’.
And 'from any to any' refers to packet source & destination not interface direction.
Reply With Quote
  #5   (View Single Post)  
Old 4 Weeks Ago
CiotBSD CiotBSD is offline
c107:b5d::
 
Join Date: Jun 2019
Location: Under /
Posts: 126
Default

It's interesting to read the PF Faq, particularly the shortcuts for creating ruleset, on the section "Elimination of keywords", it explains to define a default deny policy, to return or drop - it's up to you - and use only:

Code:
block
Egual, you can use only:
Code:
block in/out
Because there are same clauses than:
Code:
block in/out all
- https://www.openbsd.org/faq/pf/shortcuts.html#elim
__________________
GPG:Fingerprint ed25519 : 072A 4DA2 8AFD 868D 74CF 9EA2 B85E 9ADA C377 5E8E
GPG:Fingerprint rsa4096 : 4E0D 4AF7 77F5 0FAE A35D 5B62 D0FF 7361 59BF 1733
Reply With Quote
  #6   (View Single Post)  
Old 4 Weeks Ago
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 7,106
Default

You may use # pfctl -s rules to determine exactly how your loaded rule set is interpreted by PF. See the pfctl(8) man page for details and for additional modifier options.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
To block Facebook with PF sabrina OpenBSD Security 2 16th June 2020 05:45 PM
pf block command help newbsdied OpenBSD Security 1 7th November 2010 12:50 AM
Block IDM-DAP-P2P mohammadreza OpenBSD Security 5 25th February 2010 09:59 AM
block spam milo974 OpenBSD Security 1 26th May 2009 11:30 AM
Automaticaly block IPs with PF DNAeon FreeBSD Installation and Upgrading 7 20th February 2009 02:06 AM


All times are GMT. The time now is 06:28 PM.


Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2020, Jelsoft Enterprises Ltd.
Content copyright © 2007-2010, the authors
Daemon image copyright ©1988, Marshall Kirk McKusick