download

TranslationThe NAT (nat, binat) as well as redirection and port forwarding rules (rdr) areplaced in this section. NAT is discussed later in this chapter.Chapter 12Filter RulesThis is the most important part of the configuration file where most of the actualpacket-filtering rules reside. All the lines starting with block and pass actions areplaced under this section.There are a number of things that you should remember while dealing with PFconfiguration. First of all, remember that unlike IPFW, in which the first matchingrule wins, in PF, the last matching rule wins. This means that the packet is evaluatedagainst rules and it would match different rules within the ruleset. But the last matchis always taken into account, and the action specified by the last match is enforced.However, the quick keyword is an exception to the rule. When a packet matchesa rule with a quick keyword, no more rules are evaluated and an action isenforced immediately.Unlike the IPFW, that had an explicit deny or pass rule at the end of our ruleset, herewe have the explicit rule at the beginning of the ruleset.Each filter rule has an action and criteria that if a packet matches with the criteria, itwill be processed with associated action:pass in quick on $ext_if proto tcp from any to $ext_if port 22This line from our configuration sample has a pass action for any packet thatmatches its criteria. The criteria states that the action should be enforced on packetscoming inside (hence the in keyword) from outside, on the interface fxp0 (extractedfrom $ext_if variable).Their layer4 protocol is TCP, layer4 destination is port 22,and their layer3 destination is the address that we have on fxp0 interface. Once thiscriteria is met, the action is immediately enforced; hence the quick keyword. In case,there is no quick keyword in the rule, the packet is evaluated against all remainingrules until it reaches the end of ruleset.Controlling PFThe pfctl(8) utility is the universal control utility for the PF firewall. It is used tocommunicate with PF driver to send commands or query for information.You can disable PF filtering engine by running pfctl -d and enabling it by usingthe pfctl -e commands. This is useful when you want to temporarily disableyour firewall.[ 197 ]