PF pf reloading

iPodClassic

iPodClassic

New to FreeBSD and PF. How do I reload my pf rules after making changes to the anchor file or pf.conf?
I usually go pfctl -a my.anchor -Fr or simply pfctl -Fr (I guess -a is for when you have more than one anchor and you only want to flush one of them, correct? And pfctl -Fr would flush all anchors referenced in the pf.conf file?):

Code: 
-F modifier
             Flush the filter parameters specified by modifier (may be
             abbreviated) [...]
-F rules      Flush the filter rules.

I've also tried pfctl -f /etc/pf.conf and it worked as well:
Code: 
-f file
             Load the rules contained in file.  This file may contain macros,
             tables, options, and normalization, queueing, translation, and
             filtering rules.  With the exception of macros and tables, the
             statements must appear in that order.

And also tried service pf reload and it worked as well.
Is there any best practice for production environments? What are the implications of each option?
 
iPodClassic said:
And also tried service pf reload and it worked as well.
Click to expand...
It does a syntax check with -n then a pfctl -f /etc/pf.conf.

Code: 
pf_reload()
{
        echo "Reloading pf rules."
        pf_resync
}

pf_resync()
{
        $pf_program -n -f "$pf_rules" $pf_flags || return 1
        $pf_program -f "$pf_rules" $pf_flags
}

I typically reload with pfctl -f /etc/pf.conf.

If you do remote work you might want to take a different approach though, as you might lock yourself out if you mess up the rules.

pfctl -f /etc/pf.conf.new && sleep 60 && pfctl -f /etc/pf.conf
If you accidentally lock yourself out wait 60 seconds and the old ruleset will get loaded again.
 
I prefer the service pf reload approach. Internally this checks that there are no syntax errors in /etc/pf.conf (or the pf_rules path if set in rc.conf) and then loads ( pfctl -f $pf_rules) it.

Note that established TCP connections are not disconnected when reloading rules. By default, pf's TCP rules are only evaluated during the initial SYN packet processing of the three-way handshake. So even if your new rules would block a connection, if one was already in the established state when the new rules are loaded, it will continue to function. Be sure to verify that needed connections are able to be newly established after updating rules.
 
iPodClassic said:
Fantastic. I love this! I will start using it from now on an alias.
Click to expand...
I'm using a similar yet slightly different approach: On remote hosts that I absolutely cannot loose access to (i.e. no IPMI or other means of OOB access) I have a minimalistic pf.conf.failsafe which basically only allows ssh from a limited set of IPs and 'pf reload' is an alias to pfctl -f /etc/pf.conf && sleep 60 && pfctl -f /etc/pf.conf.failsafe.
 
You must log in or register to reply here.
Back
Top