diff options
Diffstat (limited to 'share/man/man5/pf.conf.5')
| -rw-r--r-- | share/man/man5/pf.conf.5 | 42 |
1 files changed, 21 insertions, 21 deletions
diff --git a/share/man/man5/pf.conf.5 b/share/man/man5/pf.conf.5 index f491a9159ba..ae3cd3f8747 100644 --- a/share/man/man5/pf.conf.5 +++ b/share/man/man5/pf.conf.5 @@ -1,4 +1,4 @@ -.\" $OpenBSD: pf.conf.5,v 1.423 2009/04/15 07:21:26 jmc Exp $ +.\" $OpenBSD: pf.conf.5,v 1.424 2009/04/15 08:27:08 sobrado Exp $ .\" .\" Copyright (c) 2002, Daniel Hartmeier .\" All rights reserved. @@ -1911,7 +1911,8 @@ For instance: .Bd -literal -offset indent block all pass out proto tcp from any to any modulate state -pass in proto tcp from any to any port 25 flags S/SFRA modulate state +pass in proto tcp from any to any port 25 flags S/SFRA \e + modulate state .Ed .Pp Note that modulated connections will not recover when the state table @@ -2104,7 +2105,7 @@ by the block rule. .Bd -literal -offset indent block quick from \*(Ltbad_hosts\*(Gt pass in on $ext_if proto tcp to $webserver port www keep state \e - (max-src-conn-rate 100/10, overload \*(Ltbad_hosts\*(Gt flush global) + (max-src-conn-rate 100/10, overload \*(Ltbad_hosts\*(Gt flush global) .Ed .Sh OPERATING SYSTEM FINGERPRINTING Passive OS Fingerprinting is a mechanism to inspect nuances of a TCP @@ -2368,8 +2369,7 @@ ext_if = \&"kue0\&" block on $ext_if all anchor spam pass out on $ext_if all -pass in on $ext_if proto tcp from any \e - to $ext_if port smtp +pass in on $ext_if proto tcp from any to $ext_if port smtp .Ed .Pp blocks all packets on the external interface by default, then evaluates @@ -2378,8 +2378,7 @@ all rules in the named "spam", and finally passes all outgoing connections and incoming connections to port 25. .Bd -literal -offset indent -# echo \&"block in quick from 1.2.3.4 to any\&" \&| \e - pfctl -a spam -f - +# echo \&"block in quick from 1.2.3.4 to any\&" \&| pfctl -a spam -f - .Ed .Pp This loads a single rule into the @@ -2426,8 +2425,7 @@ spam are only evaluated for packets with destination port 25. Hence, .Bd -literal -offset indent -# echo \&"block in quick from 1.2.3.4 to any" \&| \e - pfctl -a spam -f - +# echo \&"block in quick from 1.2.3.4 to any" \&| pfctl -a spam -f - .Ed .Pp will only block connections from 1.2.3.4 to port 25. @@ -2715,10 +2713,10 @@ line = ( option | pf-rule | nat-rule | binat-rule | rdr-rule | include ) option = "set" ( [ "timeout" ( timeout | "{" timeout-list "}" ) ] | - [ "ruleset-optimization" [ "none" | "basic" | "profile" ]] | - [ "optimization" [ "default" | "normal" | - "high-latency" | "satellite" | - "aggressive" | "conservative" ] ] + [ "ruleset-optimization" [ "none" | "basic" | + "profile" ] ] | + [ "optimization" [ "default" | "normal" | "high-latency" | + "satellite" | "aggressive" | "conservative" ] ] [ "limit" ( limit-item | "{" limit-list "}" ) ] | [ "loginterface" ( interface-name | "none" ) ] | [ "block-policy" ( "drop" | "return" ) ] | @@ -2732,14 +2730,15 @@ option = "set" ( [ "timeout" ( timeout | "{" timeout-list "}" ) ] | pf-rule = action [ ( "in" | "out" ) ] [ "log" [ "(" logopts ")"] ] [ "quick" ] - [ "on" ifspec ] [ "fastroute" | route ] [ af ] [ protospec ] - hosts [ filteropts ] + [ "on" ifspec ] [ "fastroute" | route ] [ af ] + [ protospec ] hosts [ filteropts ] logopts = logopt [ [ "," ] logopts ] logopt = "all" | "user" | "to" interface-name filteropts = filteropt [ [ "," ] filteropts ] -filteropt = user | group | flags | icmp-type | icmp6-type | "tos" tos | +filteropt = user | group | flags | icmp-type | icmp6-type | + "tos" tos | ( "no" | "keep" | "modulate" | "synproxy" ) "state" [ "(" state-opts ")" ] | "scrub" "(" scrubopts ")" | "fragment" | "allow-opts" | @@ -2775,7 +2774,7 @@ antispoof-rule = "antispoof" [ "log" ] [ "quick" ] table-rule = "table" "\*(Lt" string "\*(Gt" [ tableopts ] tableopts = tableopt [ tableopts ] -tableopt = "persist" | "const" | "counters" | "file" string | +tableopt = "persist" | "const" | "counters" | "file" string | "{" [ tableaddrs ] "}" tableaddrs = tableaddr-spec [ [ "," ] tableaddrs ] tableaddr-spec = [ "!" ] tableaddr [ "/" mask-bits ] @@ -2825,8 +2824,9 @@ protospec = "proto" ( proto-name | proto-number | proto-list = ( proto-name | proto-number ) [ [ "," ] proto-list ] hosts = "all" | - "from" ( "any" | "no-route" | "urpf-failed" | "self" | host | - "{" host-list "}" | "route" string ) [ port ] [ os ] + "from" ( "any" | "no-route" | "urpf-failed" | "self" | + host | "{" host-list "}" | "route" string ) [ port ] + [ os ] "to" ( "any" | "no-route" | "self" | host | "{" host-list "}" | "route" string ) [ port ] @@ -2869,8 +2869,8 @@ tos = ( "lowdelay" | "throughput" | "reliability" | [ "0x" ] number ) state-opts = state-opt [ [ "," ] state-opts ] -state-opt = ( "max" number | "no-sync" | timeout | "sloppy" | "pflow" | - "source-track" [ ( "rule" | "global" ) ] | +state-opt = ( "max" number | "no-sync" | timeout | "sloppy" | + "pflow" | "source-track" [ ( "rule" | "global" ) ] | "max-src-nodes" number | "max-src-states" number | "max-src-conn" number | "max-src-conn-rate" number "/" number | |