Contributed by jose on from the pf-continues-to-kick-ass. dept.
This is something I have been dreaming about for a while, glad to see it's taking shape!From: Daniel HartmeierDate: Thu, 5 Dec 2002 17:47:32 -0700 (MST) To: source-changes@cvs.openbsd.org Subject: CVS: cvs.openbsd.org: src CVSROOT: /cvs Module name: src Changes by: dhartmei@cvs.openbsd.org 2002/12/05 17:47:32 Modified files: sbin/pfctl : pfctl.8 parse.y pfctl.c pfctl_parser.c share/man/man5 : pf.conf.5 sys/net : pfvar.h pf.c pf_ioctl.c pf_norm.c usr.sbin/authpf: authpf.c Log message: Introduce anchors and named rule sets, allowing to load additional rule sets with pfctl and evaluate them from the main rule set using a new type of rule (which will support conditional evaluation soon). Makes maintenance of sub-rulesets simpler for pfctl and daemons. Idea and ok deraadt@
(Comments are closed)
By Anonymous Coward () on
Thanks!
Comments
By Anonymous Coward () on
Comments
By Anonymous Coward () on
By Anonymous Coward () on
-current pf.conf manpage -current pfctl manpage
By Daniel Hartmeier () daniel@benzedrine.cx on http://www.benzedrine.cx/pf.html
anchor foo proto tcp from any to any port smtp
and then load into anchor foo
block quick from 1.2.3.4 to any
block quick from 2.3.4.5 to any
...
These rules will only be evaluated for packets that match the parameters on the anchor rule, for TCP packets with destination port 25.
Skip steps optimize both evaluation of the main rule set as any named rule sets in anchors. And the anchor rules in the main rule set are skipped over with skip steps, when possible.
Daniel
Comments
By Anonymous Coward () on
By Anonymous Coward () on
Comments
By Can Erkin Acar () on
Ipf groups has a more general syntax since it also uses/needs groups for (manual) rule optimization. In pf optimization is done automagically using skip steps which as a bonus also optimize anchor rule evaluation.
By Anonymous Coward () on
By niekze () on
I only wish Darren Reed wrote Sendmail...
Comments
By Anonymous Coward () on
Comments
By Anonymous Coward () on
By Anonymous Coward () on
By Anonymous Coward () on
Comments
By Anonymous Coward () on
How would you accomplish this with a web interface?
Comments
By Raymond Morsman () raymond@dyn.org on mailto:raymond@dyn.org
By Anonymous Coward () on