pf question about rules

W

wonslung

I was wondering if theres a way to load rules dynamically when they are needed.


Let's say you have xbox live and you want to load the nat rules for it but only when the xbox is actually on. I've read how to load rules with an anchor on this site: https://calomel.org/pf_config.html

but if i understand that correctly i would need to load them each time manually. Is there any way to load them automatically? I don't exactly like the idea of uPnP but if there was a way to set it to ONLY allow SPECIFIC rules from specific hosts...then it might not be so bad.
 
wonslung said:
I was wondering if theres a way to load rules dynamically when they are needed.
Click to expand...

http://www.openbsd.org/faq/pf/anchors.html

Let's say you have xbox live and you want to load the nat rules for it but only when the xbox is actually on. I've read how to load rules with an anchor on this site: https://calomel.org/pf_config.html

but if i understand that correctly i would need to load them each time manually. Is there any way to load them automatically? I don't exactly like the idea of uPnP but if there was a way to set it to ONLY allow SPECIFIC rules from specific hosts...then it might not be so bad.
Click to expand...
With net/miniupnpd you have quite a lot of control. It's really easy to see which rules are loaded.
 
so you can set it to only allow...say, xbox from a specific ip?
i couldnt' find any howto's for miniupnpd

also, i read the anchor thing..but i was confused....mainly by the post i linked...it sounds like it will only work if i load it manually...

I guess miniupnpd would be fine if it has a config file which will allow me to be specific about what i'll allow.
 
Miniupnpd uses anchors ;)

# pfctl -a miniupnpd -s rules
# pfctl -a miniupnpd -s nat
Shows the specific rules/nat lines, this makes it relatively easy to keep an eye on it.

Because miniupnpd uses anchors you can put them in your config where you want them. If you get a little creative you can block UPnP traffic (5000/1900 udp/tcp) from certain hosts while allowing others.
 
SirDice said:
Miniupnpd uses anchors ;)

# pfctl -a miniupnpd -s rules
# pfctl -a miniupnpd -s nat
Shows the specific rules/nat lines, this makes it relatively easy to keep an eye on it.

Because miniupnpd uses anchors you can put them in your config where you want them. If you get a little creative you can block UPnP traffic (5000/1900 udp/tcp) from certain hosts while allowing others.
Click to expand...

ahh, ok...but theres no way to just dynamically load a specific rule set "on the fly"?

as a fallback miniupnp sounds ok i guess...

ideally i'd like to be able to have a way that can detect that packets are moving to the xbox and automatically load the rules to allow xbox live, then when they stop, flush the rules..

but worst case i'll either do what you suggest or just set the rules on all the time...
 
wonslung said:
ahh, ok...but theres no way to just dynamically load a specific rule set "on the fly"?
Click to expand...
Not sure what you are planning but you can load a different ruleset at any time, for example:
# pfctl -f /etc/pf.xbox.conf
This will load a complete ruleset named pf.xbox.conf

Or you can use anchors to add/remove additional rules:
# pfctl -a xbox -f /etc/pf.xbox.conf
This will load additional rules in an existing ruleset at the xbox anchor.

but worst case i'll either do what you suggest or just set the rules on all the time...
Click to expand...
I don't have an xbox but I know messenger on Windows likes having UPnP :)
 
SirDice said:
Not sure what you are planning but you can load a different ruleset at any time, for example:
# pfctl -f /etc/pf.xbox.conf
This will load a complete ruleset named pf.xbox.conf

Or you can use anchors to add/remove additional rules:
# pfctl -a xbox -f /etc/pf.xbox.conf
This will load additional rules in an existing ruleset at the xbox anchor.


I don't have an xbox but I know messenger on Windows likes having UPnP :)
Click to expand...




I Know i can load a ruleset at any time. I don't want to HAVE to load it. Ideally, i would like to set up some kind of daemon that looks for the client with an ip 192.168.1.10 or mac address
xx:xx:xx:xx whatever to try to make a connection. When this client becomes active, then load rules for xbox live.

When it is not active, flush the rules.

I guess this isn't possible. What would be nice is a way to have upnp with a config to only allow specific host to access a specific port/ports or a way to dynamically load the rules when they are needed and automatically flush them when they aren't

I'm sure it's possible with some sort of clever rules and trickery. I know i can't be the only one who wants this type of a feature.
 
What's the point of doing something like what you suggest? If the xbox is off, it's not going to have traffic and the rules for it won't hurt anything. (I'm not trying to be a jerk, but am genuinely curious.)

Is the xbox connected to the bsd box via it's own interface or via a switch/hub? If by it's own interface, you could write a daemon to watch the log files for a message indicating that the state of the line has changed and fire the appropriate pfctl commands based on that. There may also be a trigger already present to activate on such an event; I don't know.
 
wonslung said:
I'm sure it's possible with some sort of clever rules and trickery. I know i can't be the only one who wants this type of a feature.
Click to expand...
Something like this would probably do the trick:
Code: 
xbox="192.168.1.123"

block in quick on $lan_if from !$xbox to any port 1900 
block in quick on $lan_if from !$xbox to any port 5000

anchor "miniupnpd"

The 2 block statements will block any UPnP traffic except from the xbox.
 
thanks, can you also do something like
Code: 
block in quick on $lan_if from !{$xbox, $xbox2} to any port 1900 
block in quick on $lan_if from !{$xbox, $xbox2} to any port 5000
 
wonslung said:
thanks, can you also do something like
Code: 
block in quick on $lan_if from !{$xbox, $xbox2} to any port 1900 
block in quick on $lan_if from !{$xbox, $xbox2} to any port 5000
Click to expand...

It'll be easier to do:
Code: 
xboxes="{192.168.1.123, 192.168.1.124}"
Then use $xboxes, but yeah, yours should also work.
 
SirDice said:
It'll be easier to do:
Code: 
xboxes="{192.168.1.123, 192.168.1.124}"
Then use $xboxes, but yeah, yours should also work.
Click to expand...

cool, i like yours better.
thanks again for all the help. I think i'm going to pull the trigger on this thing tonight.
 
You must log in or register to reply here.
Back
Top