Packet Filter (PF) Question(s)

[markfisher]

Hi

I have some questions about Packet Filter (PF):

• I moved pf.conf and pf.os files from /etc to /etc/firewall. In my Packet Filter configuration file, pf.conf, I have
  

  set fingerprints "/etc/firewall/pf.os"

  and in my rc.conf, I have
  

  ...
  pf_rules="/etc/firewall/pf.conf"
  ...

  Now every time I reboot the system, I get the message:
  

  pfctl: /etc/pf.os: No such file or directory.

  I went through the man page for pfctl to find the option to specify the new location for pf.os but no luck (I might have missed something). How can I tell pfctl the new location of that file?

• 
  I might be wrong, but what I understand that Packet Filter anchor rules are dynamic (Am I right?). So the FTP proxy (ftp-proxy) should not work if I have (in rc.conf)
  

  ...
  kern_securelevel="3" # Disable run-time tweaking of firewall configuration
  ...

  Am I right?

Thanks
Mark

 

[krzysiekb81]

Hi

The pf.os location is defined in /usr/src/contrib/pf/pfctl/pfctl_parser.h:

#define PF_OSFP_FILE             "/etc/pf.os"