From owner-freebsd-questions@FreeBSD.ORG Thu Jan 19 22:27:37 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4894216A41F for ; Thu, 19 Jan 2006 22:27:37 +0000 (GMT) (envelope-from jdow@earthlink.net) Received: from smtpauth01.mail.atl.earthlink.net (smtpauth01.mail.atl.earthlink.net [209.86.89.61]) by mx1.FreeBSD.org (Postfix) with ESMTP id BE1A143D48 for ; Thu, 19 Jan 2006 22:27:36 +0000 (GMT) (envelope-from jdow@earthlink.net) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=dk20050327; d=earthlink.net; b=IweY3sjxOqPvJ0AzI7yYAzi/UzNEez9B99HSRu4mze8B8VDpacIxhnSoceRZNcJl; h=Received:Message-ID:From:To:Subject:Date:MIME-Version:Content-Type:Content-Transfer-Encoding:X-Priority:X-MSMail-Priority:X-Mailer:X-MimeOLE:X-ELNK-Trace:X-Originating-IP; Received: from [71.116.161.209] (helo=kittycat) by smtpauth01.mail.atl.earthlink.net with asmtp (Exim 4.34) id 1EziFj-00028f-P4 for freebsd-questions@freebsd.org; Thu, 19 Jan 2006 17:27:36 -0500 Message-ID: <006001c61d47$973bccc0$1225a8c0@kittycat> From: "jdow" To: Date: Thu, 19 Jan 2006 14:27:53 -0800 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2670 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670 X-ELNK-Trace: bb89ecdb26a8f9f24d2b10475b571120bdd8d6e63f466831208320e3a48b7dc1df4dea5d24d49372350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c X-Originating-IP: 71.116.161.209 Subject: Re: How to tell if IPF is running? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 19 Jan 2006 22:27:37 -0000 From: "Erik Norgaard" Nce writeup. I do have one question at the bottom. > I used IPF on FBSD until there was some bug in IPF for 5.x some version > that forced me to switch after an upgrade. The bug has been fixed since > but I have found no reason to go back. > > There are two things I miss from IPF: > > a) proper accounting: You can't count traffic correctly with stateful > filtering on pf, pf will count when a rule is matched but once a state > is established packets for that state are not matched and hence not counted. > > b) an active and inactive ruleset: To load a new ruleset you'll have to > flush everything. You can check syntax of rules before loading and pf > loads all or nothing, so if there is a syntax error in your ruleset it > won't be loaded. BUT: You may make syntactically correct changes that > yet contain errors: Just say you wrote: > > block in all from 10.0.0.0/2 > > but meant > > block in all from 10.0.0.0/24 > > In IPF I always used: > > # ipf -s && sleep 60 && ipf -s > > to give me 60 seconds to verify that I didn't lock myself out. > > Now, that is compensated by in PF you can flush and reload the rules > only, keeping existing states, so the connection you use for maintenance > is not torn down. > > The pros for PF are some features to prevent DDoS against servers behind > your firewall, and advanced queuing features and CARP. The use of macros > and tables makes it easier to maintain rules, but the lack of groups > means you have to be more careful structuring your ruleset: > > Rules are read top down _always_ in IPF I really liked groups, even > though I always kept rules together. It just made it more explicit that > rules went the same place. PF uses some clever skip ahead to gain the > speed that proper use of groups give in IPF, and tests have shown that > pf is faster than IPF in particular when rulesets grow large. > > but you need to be careful writing rules: > > IPF sample: > > block in quick from 10.0.0.0/24 to any head 10 > pass in quick from 10.0.0.0/24 to 192.168.0.0/24 group 10 > > PF sample: > > block in from 10.0.0.0/24 to any > pass in quick from 10.0.0.0/24 to 192.168.0.0/24 > block in quick from 10.0.0.0/24 to any > > The thing is that in the first line of the IPF sample, a default action > is made for that group. packets matching the head rule but no rules in > the group will take that action. > > In PF you'll have to include that extra rule in the end to get the same > behavior. > > So, in short, ipf is really simple and comparatively easy to work with, > the lack of macros means you generally have to write more but this also > makes it more explicit what happens as packets traverse the ruleset. > > pf has some really nice features in particular in more complex setups. > The use of macros means that you can create compact rulesets that can > easily be adopted to other systems or setups. > > Use what you feel most comfortable with. OK, I am coming from a Linux iptables world. I have a nicely working firewall in that realm including the following nice little tidbit that allows me to be anywhere in the world and ssh into the machine while making ssh dictionary attacks really "expensive". ===8<--- $IPTABLES -A INPUT -p tcp --syn --dport 22 -m recent --name sshattack --set $IPTABLES -A INPUT -p tcp --dport 22 --syn -m recent --name sshattack \ --rcheck --seconds 120 --hitcount 3 -j LOG --log-prefix 'SSH REJECT: ' $IPTABLES -A INPUT -p tcp --dport 22 --syn -m recent --name sshattack \ --rcheck --seconds 120 --hitcount 3 -j REJECT --reject-with tcp-reset ===8<--- The trap allows up to three tries within a 120 second period before blocking the IP address responsible until the tries within the last 120 seconds is below 3. I've found that attacks will start. Then they will simply spend an hour or two generating log entries for the rejects. (I then add the net block for the source to another rule that blocks it entirely for ssh.) I have similar blocks on pop3s and imaps. Which tool would be able to do this sort of thing best and how might it have been done. {^_^} Joanne, getting tired of the Linux perpetual beta test.