Re: Learning how-to pf "right"

On Wed, 13 May 2015 00:36:54 +0200
Dennis Steinkamp <[email protected]> wrote:

> i am a heavy pfsense user and i thought why not spend a little 
> "free-time" and learn more about "pf" itself. :)
> So i got myself a copy of the 3rd edition of "The book of Pf" and 
> started to work with it.

> Let me show you my current ruleset first:
> 
> 1.) block all
> 2.) set skip on lo
> 3.) match out on egress inet from $int_net nat-to egress
> 4.) pass in on $int_if from $int_net to *any*
> 5.) pass out on $ext_if from $ext_if to any

There is one more thing you can do to be a good neighbor.
The following rule foils people who would use you to mount
a sequence number spoofing attack on someone else.
(You would play the role of "A" in rfc1948.)

 block in on $ext_if proto tcp flags sa/sa return-rst 

There are a number of caveats here.   I did not take
this from a working pf config, I made it up for this
email and it's not tested.  Further, for all I know
OpenBSD already does this by default unless you set
some sort of sysctl or something, because you should
never see a stateless packet with both syn and ack set.
(Or maybe this should be a setting built into pf?)
Finally, you'd hope that today's tcp stacks would behave
politely and send a rst when receiving a packet with
syn and ack set out of the blue.  But that's probably
too much to hope for.

Perhaps someone else can chime in and note whether
this rule is still appropriate.


Karl <[email protected]>
Free Software:  "You don't pay back, you pay forward."
                 -- Robert A. Heinlein