From owner-freebsd-pf@FreeBSD.ORG Wed Aug 20 14:38:55 2008 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 3AF711065681 for ; Wed, 20 Aug 2008 14:38:55 +0000 (UTC) (envelope-from jdc@parodius.com) Received: from mx01.sc1.parodius.com (mx01.sc1.parodius.com [72.20.106.3]) by mx1.freebsd.org (Postfix) with ESMTP id 275578FC24 for ; Wed, 20 Aug 2008 14:38:55 +0000 (UTC) (envelope-from jdc@parodius.com) Received: by mx01.sc1.parodius.com (Postfix, from userid 1000) id 1505F1CC0BC; Wed, 20 Aug 2008 07:38:55 -0700 (PDT) Date: Wed, 20 Aug 2008 07:38:55 -0700 From: Jeremy Chadwick To: Leslie Jensen Message-ID: <20080820143855.GA40160@eos.sc1.parodius.com> References: <48AC266D.2030902@eskk.nu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <48AC266D.2030902@eskk.nu> User-Agent: Mutt/1.5.18 (2008-05-17) Cc: freebsd-pf@freebsd.org Subject: Re: port stealth mode? X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Aug 2008 14:38:55 -0000 On Wed, Aug 20, 2008 at 04:13:01PM +0200, Leslie Jensen wrote: > I've done some testing with Steve Gibsons "Shields up" > https://www.grc.com/x/ne.dll?bh0bkyd2 > > These tests lists the ports as closed but visible. > > Instead the site suggest that one uses stealth so that the ports are not > visible from the Internet. > > Is there a way to achieve this with PF? The "block" directive, along with "set block-policy drop" should suffice for accomplishing this in pf. -- | Jeremy Chadwick jdc at parodius.com | | Parodius Networking http://www.parodius.com/ | | UNIX Systems Administrator Mountain View, CA, USA | | Making life hard for others since 1977. PGP: 4BD6C0CB |