Hello guys and gals, I tried these in VirtualBox running FreeBSD and they both work; but I not 100% clear on which to use for a stand-alone FreeBSD workstation. I kind of figure that the first one would be used for networking on a LAN of the Normalization statement scrub all, possibly meaning in on all interfaces (but without the in as the OpenBSD PF manual say but only scrub all work for FreeBSD, but I’m not 100% sure of that either.
I also wonder why the first one use the keyword tcp and the other does not? … Are my comments concerning direction correct? I know my questions may be confusing but if you read into the links below: keyword scrub and pass on (scrub on hint to me) for the first link you’ll know what I mean. The tiny differences in each may need to be sorted into one that makes it clear for FreeBSD. I’m not sure, so I ask.
Which of these is more correct for a desktop/workstation?
https://srobb.net/pf.html
http://ftp.tuwien.ac.at/.vhost/www.openbsd.org/www/faq/pf/scrub.html
https://forums.freebsd.org/threads/24215/
I also wonder why the first one use the keyword tcp and the other does not? … Are my comments concerning direction correct? I know my questions may be confusing but if you read into the links below: keyword scrub and pass on (scrub on hint to me) for the first link you’ll know what I mean. The tiny differences in each may need to be sorted into one that makes it clear for FreeBSD. I’m not sure, so I ask.
Code:
scrub out on …. allow out only
scrub on … allow in and out
Code:
scrub all no-df random-id min-ttl 5 max-mss 1440 reassemble tcp # in on all interfaces
scrub out on $ext_if no-df random-id # out only
scrub on $ext_if all reassemble tcp # in and out
Code:
scrub in on $ext_if all fragment reassemble min-ttl 15 max-mss 1400 # in on host interfaces
scrub in on $ext_if all no-df # in only
scrub on $ext_if all reassemble tcp # in and out
http://ftp.tuwien.ac.at/.vhost/www.openbsd.org/www/faq/pf/scrub.html
https://forums.freebsd.org/threads/24215/