Fincer
/
openntpd-openbsd
mirror of https://github.com/Fincer/openntpd-openbsd
1
0
Fork 0
Code Issues 0 Projects 0 Releases 61 Wiki Activity
Source code pulled from OpenBSD for OpenNTPD. The place to contribute to this code is via the OpenBSD CVS tree.
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
8709 Commits
49 Branches
29 MiB
Tree: dd54085a20
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from 'dd54085a20'
${ noResults }
openntpd-openbsd/src/etc/pf.conf

14 lines
388 B
Raw Normal View History

Disallow the _pbuild user from making TCP/UDP connections in the default PF ruleset. This is not a complete block on _pbuild being able to communicate (e.g. non-TCP/UDP protocols don't have a PCB with userid, so PF can't restrict in those cases) but avoids some cases, and in particular makes it more obvious when a port does things like download extra distfiles or dependencies as part of the build process. Slight tweak from a diff by espie@.
6 years ago
pf rule sets; ok deraadt@
23 years ago
Shrink this to the minimum, but reference /etc/examples/pf.conf (someone should really sit down and flesh out the examples)
9 years ago
Give an example of how to increase the state limit. The 10k limit is too small for production servers now that pf is on by default. OK phessler@
11 years ago
A newruleset that contains actual blocks people can use if they uncomment them. this is no longer a sample. everything in here now must be completely legit. discussed at length with henning, claudio, and sthen ok sthen
15 years ago
merge nat.conf here as well add more simple filter rule examples "commit it" deraadt@
22 years ago
Change the default PF policy to "block return", including x11 as suggested by naddy@. This solves the problem that occurs when a server crashes or is hard booted and comes back up without tearing down any connections to it, and packets from these connections don't match any existing state or rule and are silenty dropped. ok phessler@ henning@ claudio@ dlg@
10 years ago
Add a 'block' rule prior to the state creating 'pass' rule. This way, TCP packets of e.g. timed out states are blocked rather than passed by the implicit default pass rule. sthen@ benno@ phessler@ mikeb@ agrees
11 years ago
A newruleset that contains actual blocks people can use if they uncomment them. this is no longer a sample. everything in here now must be completely legit. discussed at length with henning, claudio, and sthen ok sthen
15 years ago
​
Change the default PF policy to "block return", including x11 as suggested by naddy@. This solves the problem that occurs when a server crashes or is hard booted and comes back up without tearing down any connections to it, and packets from these connections don't match any existing state or rule and are silenty dropped. ok phessler@ henning@ claudio@ dlg@
10 years ago
Disallow the _pbuild user from making TCP/UDP connections in the default PF ruleset. This is not a complete block on _pbuild being able to communicate (e.g. non-TCP/UDP protocols don't have a PCB with userid, so PF can't restrict in those cases) but avoids some cases, and in particular makes it more obvious when a port does things like download extra distfiles or dependencies as part of the build process. Slight tweak from a diff by espie@.
6 years ago
​
​
 
  1. #	$OpenBSD: pf.conf,v 1.55 2017/12/03 20:40:04 sthen Exp $
  2. #
  3. # See pf.conf(5) and /etc/examples/pf.conf
  4. 

  5. set skip on lo
  6. 

  7. block return	# block stateless traffic
  8. pass		# establish keep-state
  9. 

  10. # By default, do not permit remote connections to X11
  11. block return in on ! lo0 proto tcp to port 6000:6010
  12. 

  13. # Port build user does not need network
  14. block return out log proto {tcp udp} user _pbuild