PF GUI or TUI for pf

DanielBowman

DanielBowman

No, I have not found one. I am kindly asking, if somebody has some useful tips.
I mean OPNSense and pfSense exist. There has to be some GUI or TUI to get pf running properly, even if in basic setup i.e. UFW.
 
pfstat does not build , unmaintained with

error: use of undeclared identifier 'DIOCGETSTATUS'

Variable seems to have changed name in header file <net/pfvar.h > to DIOCGETSTATUSNV

Maybe additional changes since the code is not maintaind for 1 year.
 
DanielBowman said:
I mean OPNSense and pfSense exist.
Click to expand...
That's for routers this is a different story.

DanielBowman said:
There has to be some GUI or TUI to get pf running properly, even if in basic setup i.e. UFW.
Click to expand...
No there is not, your best hope is to learn how to create simple rules first, after some time you'll be more comfortable with it and will be able to add rich rules.
There is a website where you can find a set of basic rules for desktop usage, I let the link of my previous answer about it.
gotnull

PF Post in thread 'What is the ideal PF config for a workstation?'

rmomota said:
Is there any recommended base pf.conf where I can start my customization?
Click to expand...
You can start with this one:
cooltrainer.org

A FreeBSD 11 Desktop How-to

A guide to a full-featured modern desktop FreeBSD installation
cooltrainer.org cooltrainer.org
Actually the entire page contains useful information for a desktop usage on FreeBSD.
  • Thanks

I don't know if you are interested by IPFW too, but I saw it has a GUI for it, never tried it but it seems to be what you are asking for, it is not in ports so you have to install it manually but it doesn't look too difficult, don't forget to install the dependencies as shown in the README.
github.com

GitHub - bsdlme/ipfwGUI: A very simple ipfwGUI for FreeBSD

A very simple ipfwGUI for FreeBSD. Contribute to bsdlme/ipfwGUI development by creating an account on GitHub.
github.com github.com
 
gotnull said:
No there is not,
Click to expand...
We used to have one. It did not help me much learning pf but it was a nice crutch. Better than cut and paste approach.
I bought the book of pf and ditched computer based training. I can always look back at it. Make notes. It will never be deleted or erased.

security/fwbuilder
It is a shame this was abandoned upstream. Although not explicitly mentioned it did build pf rules as well.
 
When it comes to firewalls, one has to understand how they function in order to build coherent rules for it. It really helps to understand the TCP/IP stack pretty thoroughly, and understand at what level the rule/filter is enforced.

For example, Windows Firewall really functions at application level, and allows you to set rules on a per-application basis. In FreeBSD, that amounts to editing the application-specific .conf file, and not even touching the firewall.

It also really helps to understand the basics behind RPN if you want to understand how the rules are actually applied to firewalls, and what the effect is.

Once you actually understand the basics that I have just outlined, it stops mattering if you have a GUI or a TUI to build a firewall rule. Kind of like the difference between command-line utilities and Dolphin - both do the same thing, and have the same effect - but it pays to know what you're doing and how it's supposed to work.

It can be time-consuming and boring to learn, but that's the price to be able to do it right, and being able to troubleshoot.
 
astyle said:
When it comes to firewalls, one has to understand how they function in order to build coherent rules for it. It really helps to understand the TCP/IP stack pretty thoroughly, and understand at what level the rule/filter is enforced.
Click to expand...
Sorry if this gets wordy.

For me the easiest way to do this is draw pictures with boxes and arrows.
A box for the firewall, a box for "my system"
Arrow into/out of the firewall to "the internet"
Arrow into/out of the firewall from/to "my system"

Arrows are the traffic
Start with "default deny" that means unless explictly allowed, it will not happen.
pf is "Last match wins" (unless you use quick), so at the top you start with deny all.
Then you ask:
What do I need to allow, in what direction?
Default deny means inbound connections that originate from outside will be rejected
Inbound connections that are a response to OUTBOUND flows (flows that originate inside your network)

Now stand on your firewall and face your internal systems and ask yourself: What do I need to allow?
DNS, NTP, SSH (outbound), HTTP, HTTPS, email. Think about them all, think about TCP/UDP, IPV4, IPV6?

I don't recall exactly how many, but doing this a functional workstation "needed" 10 or 12 ports/services open in the firewall.
Toss in NAT and your ruleset isn't that big or complex.
This is only for allowing traffic out. Traffic inbound originating from outside is still blocked.
You're still standing on your firewall, now turn around and face the world. Ask "Do I need to allow anything originating from out there?" If no, you're done. If yes, you need to think about what and how to pass it through.

Anyway, I've never been fond of a GUI tool to provision my firewall. I understand the appeal, but prefer drawing pictures and using text editors.

Firewall rules you should be able to pretend you're a packet of type ABC, walk the rules and get "allow/deny". If you can't walk your rules, it's likely too complicated.
 
drsnx60 said:
pfstat does not build, unmaintained with
error: use of undeclared identifier 'DIOCGETSTATUS'
Variable seems to have changed name in header file <net/pfvar.h> to DIOCGETSTATUSNV
Maybe additional changes since the code is not maintaind for 1 year.
Click to expand...
pfstat-2.5_8 is still in the 'latest' pkg repo, so build was success.
sys/net/pfvar.h has defined both DIOCGETSTATUS and DIOCGETSTATUSNV which are using different struct:
#define DIOCGETSTATUS _IOWR('D', 21, struct pf_status)
#define DIOCGETSTATUSNV _IOWR('D', 21, struct pfioc_nv)
 
Last edited:
mer said:
Depending on your use case, pf is not hard to get configured and running. Start with getting yourself a copy of "The Book of PF" I believe the latest version has more info about differences between OpenBSD and FreeBSD versions.

https://nostarch.com/pf3
or preorder the latest

The Book of PF, 4th Edition

Build a more secure network with PF.
nostarch.com nostarch.com
Click to expand...
I can configure pf, hopefully - no way to tell (for me) if it's any good, tho. DigitalOcean has good tutorial for example. My problem is, I study it, I set it up and I forget it. Then few months later I need to add or change the rule and I can start again with the studying and figuring out proper structure and syntax. Nothing serious, I am not a complete dummy. But compared to GUI UFW it is 10x time spend on it.
 
DanielBowman said:
I can configure pf, hopefully - no way to tell (for me) if it's any good, tho. DigitalOcean has good tutorial for example. My problem is, I study it, I set it up and I forget it. Then few months later I need to add or change the rule and I can start again with the studying and figuring out proper structure and syntax. Nothing serious, I am not a complete dummy. But compared to GUI UFW it is 10x time spend on it.
Click to expand...
Honestly, even with a GUI you wind up in the same position. my pfSense, I set up years ago and haven't touched it since. But I understand the point that "if ithe GUI is written correctly, I don't have to worry about the exact syntax. I can click buttons, check boxes, fill out forms and the GUI translates to the correct syntax".

What I found is I still go into the web ui, diagnostics, shell command and do pfctl -sR to get the rules as they are implemented to figure out problems.
 
vmisev said:
pfstat-2.5_8 is still in the 'latest' pkg repo, so build was success.
sys/net/pfvar.h has defined both DIOCGETSTATUS and DIOCGETSTATUSNV which are using different struct:
#define DIOCGETSTATUS _IOWR('D', 21, struct pf_status)
#define DIOCGETSTATUSNV _IOWR('D', 21, struct pfioc_nv)
Click to expand...

this is all I find ?? on 15-current

/usr/include/net # grep DIOCGETSTATUS < pfvar.h
#define DIOCGETSTATUSNV _IOWR('D', 21, struct pfioc_nv)


but on 14.3 :


# grep DIOCGETSTATUS < pfvar.h
#define DIOCGETSTATUS _IOWR('D', 21, struct pf_status)
#define DIOCGETSTATUSNV _IOWR('D', 21, struct pfioc_nv)

which explains why build fails on 15-current.

Build works after I added back the missing #define to /usr/include/net/pfvar.h
 
DanielBowman said:
I can configure pf, hopefully - no way to tell (for me) if it's any good, tho.
Click to expand...
This is an important point. For best results you need a second internet provider to attack yourself. (Cellular Modem in Laptop or leech off neighbors wifi)
QA your work.
Did the rule change do what you thought.
A separate management interface is nice if headless. Prevent lockouts.
 
Phishfry said:
This is an important point. For best results you need a second internet provider to attack yourself. (Cellular Modem in Laptop or leech off neighbors wifi)
QA your work.
Did the rule change do what you thought.
A separate management interface is nice if headless. Prevent lockouts.
Click to expand...
Come on, just set up a few jails, and off you go, playing with all the attack techniques you care to learn.
 
You must log in or register to reply here.
Back
Top