INDEX Note: Pages numbers followed by f, n, priority-based queues, 136–145 or t indicate figures, notes, and tables, match rule for queue assignment, respectively. 137–138 overview, 134–135 Symbols performance improvement, 136–137 # (hash mark), 13, 15 queuing for servers in DMZ, ! (logical NOT) operator, 42 142–144 setting up, 135–136 A on FreeBSD, 135–136 on NetBSD, 136 Acar, Can Erkin, 173 on OpenBSD, 135 ACK (acknowledgment) packets transitioning to priority and class-based bandwidth allocation, queuing system, 131–133 139–140 anchors, 35–36 HFSC algorithm, 124, 126, 142 authpf program, 61, 63 priority queues, 132, 137–138 listing current contents of, 92 two-priority configuration, loading rules into, 92 120–121, 120n1 manipulating contents, 92 adaptive.end value, 188 relayd daemon, 74 adaptive firewalls, 97–99 restructuring rule set with, 91–94 adaptive.start value, 188 tagging to help policy routing, 93 advbase parameter, 153–154 ancontrol command, 46n1 advskew parameter, 153–154, 158–159 antispoof tool, 27, 193–195, 194f aggressive value, 192 ARP balancing, 151, 157–158 ALTQ (alternate queuing) framework, atomic rule set load, 21 9, 133–145, 133n2 authpf program, 59–63, 60 basic concepts, 134 basic authenticating gateways, class-based bandwidth allocation, 60–62 139–140 public networks, 62–63 overview, 135 queue definition, 139–140 tying queues into rule set, 140 B handling unwanted traffic, 144–145 bandwidth operating system-based queue actual available, 142–143 assignments, 145 class-based allocation of, 139–140 overloading to tiny queues, overview, 135 144 –145 queue definition, 139–140 HFSC algorithm, 140–142 tying queues into rule set, 140 overview, 135 queues for allocation of, 121–122 queue definition, 140–141 DMZ network with traffic tying queues into rule set, shaping, 128–130 141–142 fixed, 123–125 bandwidth, queues for allocation of load balancing, 157 (continued) load-balancing mode, 158 flexible, 125–128 setting up, 158–160 HFSC algorithm, 123 overview, 147–148 total usable, 122 carpdev option, 150, 152 Beck, Bob, 115 cbq (class-based) queues, 132–135 Berkeley Software Distributions. See definition, 139–140 BSDs (Berkeley Software tying into rule set, 140 Distributions); FreeBSD; cloneable interfaces, 55n4, 167 NetBSD; OpenBSD command succeeded message, 77 blacklisting, 101–103, 115 Common Address Redundancy block all rule, 19, 24, 61, 69 Protocol. See CARP block in all rule, 16 –17 complicated networks, 65–94 blocknonip option, 87–88 bridges, 86–91 block-policy option, 186–187 FreeBSD setup, 88–89 block rule, 13 NetBSD setup, 89–90 Brauer, Henning, 5, 133, 177 OpenBSD setup, 87–88 brconfig command, 87, 89 rule set, 90–91 bridges, 86–91, 86n5, 90f interface groups, 84–85 defined, 86 NAT, 79–84 pros and cons of, 86 DMZ, 80–81 rule set, 90–91 load balancing with setting up redirection, 81 on FreeBSD, 88–89 single NATed network, 81–84 on NetBSD, 89–90 nonroutable IPv4 addresses, 91–94 on OpenBSD, 87–88 establishing global rules, 91 brute-force attacks, 96–99 restructuring rule set with defined, 96 anchors, 91–94 expiring tables using pfctl, 99 packet tagging, 85–86 overview, 96 routable IPv4 addresses, 66–79, 67f setting up adaptive firewalls, 97–99 DMZ, 70–71, 70f BSDs (Berkeley Software load balancing with redirection, Distributions), 3–4, 3n3. 72–73 See also FreeBSD; NetBSD; load balancing with relayd, OpenBSD 73–79 configuration files, 7 macros, 66–67 Linux versus, 6–7 configuration files network interface naming FreeBSD, 7, 14–15 conventions, 6 NetBSD, 15–16 online resources, 201–203 OpenBSD, 7, 13 print resources, 204–205 tools for managing, 7–8, 11 Bytes In/Out statistics, 23 connection refused message, 18 content filtering, 100, 105, 107 C Core Force project, 5n7 Core Security, 5n7 CARP (Common Address Redundancy Protocol), 79 failover, 150–154 D kernel options, 150 DDoS (distributed denial-of-service) network interface setup with attacks, 187, 187n1 ifconfig, 151–154 sysctl values, 151 212 Index debugging, 197–199. See also logging sysctl values, 151 debug option, 190–191 load balancing versus, 158 troubleshooting-friendly networks, pfsync protocol, 154–155 37–38 rule set, 155–156 debug option, 52, 190–191 false positives, 102, 106, 110, 115 deep packet inspection, 2 FIFO (first in, first out), 120, demilitarized zone (DMZ). See DMZ 132–134, 137 demotion counter, 79, 153 file servers denial-of-service (DoS) attacks, 91, NAT, 79 168, 193n2 routable IPv4 addresses, 66–67 de Raadt, Theo, 4n4 file transfer protocol. See FTP dhclient command, 56–57, 59 firewalls, 3. See also bridges dhcpd program, 54 adaptive, 97–99 distributed denial-of-service (DDoS) simple gateways, 25–27 attacks, 187, 187n1 first in, first out (FIFO), 120, divert(4) sockets, 2 132–134, 137 diver t-to component, 36 flags S/SA keep state rule, 21 Dixon, Jason, 10 floating state policy, 187 dmesg command, 48–49, 209 Floeter, Reyk, 183 DMZ (demilitarized zone) flowd collector daemon, 177–182 NAT, 80–81 flowd-reader program, 178 –181 queuing for servers in, 142–144 flow-tools program, 177 routable IPv4 addresses, 70–71, 70f flush global state-tracking option, 97 testing rule set, 195–196, 195f fragment reassembly options, 192–193 with traffic shaping, 128–130, 128f frag value, 188 DNS, 22, 34n4, 66, 68 FreeBSD, 3n3, 5 documentation, 8 configuration files, 7 domain name lookups, 163–164, online resources, 204 166, 169 pfSense, 8 domain name resolution, 18, 20 setting up ALTQ framework on, domain names, 34 135–136 DoS (denial-of-service) attacks, 91, setting up bridges, 88–89 168, 193n2 setting up PF on, 13–15 DragonFly BSD, 3n3, 5–6, 12 spamd spam-deferral daemon, dropped packets, 128 101, 105 drop value, 186 wireless interface configuration, 50 wireless network setup, 58–59 E WPA access points, 52–53 FreeBSD Handbook, 14 echo requests/replies, 38–41, 53, 69, from keyword, 33 82, 90, 92 FTP (file transfer protocol), 35–37, Engen, Vegard, 62n5 53–54 expiretable tool, 99n4 fetching list data via, 102 ftp-proxy with diversion or F redirection, 36–37 history of, 35, 35n5 failover, 148–156 security challenges, 35 CARP, 79, 150 variations on ftp-proxy setup, 37 kernel options, 150 ftp-proxy command, 13 network interface setup with enabling, 36 ifconfig, 151–154 redirection, 36–37 reverse mode, 36–37 Index 213 ftpproxy_flags variable, 36–37 I FTPS, 35n6 IBM Christmas Tree EXEC worm, 2n1 fw_update script, 48 ICMP, 37–41, 41n7, 124, 140 bandwidth allocation, 124 G letting pass unconditionally, 38 grep program, 113, 178 letting pass while stopping probes greyexp value, 107 from elsewhere, 39 greylisting, 104–108 path MTU discovery, 40–41 compensating for unusual ICMP6, 38 situations, 113–114 letting pass unconditionally, 38 defined, 104 letting pass while stopping probes keeping lists in sync, 112–113 from elsewhere, 39 online resources, 205–206 path MTU discovery, 41 in practice, 107–108 if-bound policy, 187–188 setting up, 104–105, 107 if_bridge module, 88 greytrapping, 109–111, 115 ifconfig command, 46n1, 59, 109, 148 adding to list, 111–112 bridge setup, 87–89 deleting from list, 112 interface groups, 84–85 logging, 167, 176 MTU, 40 H redundancy and resource Hail Mary Cloud sequence of brute- availability, 150–155, force attempts, 98, 98n2 158–160 hardware, 5, 207–210 running status of interfaces, 30 helping hardware support wireless networks, 49–53, 56–59 efforts, 210 ifstated interface state daemon, 157 issues facing hardware support ILOVEYOU worm, 2n1 developers, 209 inserts statistic, 23 pool memory, 190 interface groups, 84–85 selecting, 208–209 Interface Stats statistics, 23 selecting for wireless networks, 48 interval value, 188 Harris, Evan, 104 IP-based load balancing, 157–158 Hartmeier, Daniel, 4–5, 132, 136 IPFilter subsystem, 4–5, 4n4, 4n5, 8–9 hash mark (#), 13, 15 IPsec HFSC (Hierarchical Fair Service filtering on encapsulation Curve) algorithm, 123, interfaces, 55, 55n4 125–126, 134–135, 140–142 state synchronization, 155 queue definition, 140–141 with UDP key exchange, 55 transitioning from ALTQ to IPv4, 23–24 priority and queuing network address translation, system, 132–133 28–29, 54 tying queues into rule set, 141–142 nonroutable addresses, 91–94 high-latency value, 192 establishing global rules, 91 hostapd command, 52–53 restructuring rule set with host command, 18, 22, 34 anchors, 91–94 hostnames, 34 packet forwarding, 30 HTTP, 68, 75, 77–79, 99 routable addresses, 31–32, 66–79 fetching list data via, 102 DMZ, 70–71 NetFlow data collection, 181 load balancing with relayd, HTTPS, 77, 79 73–79 214 Index load balancing with redirection, NetFlow data collection, 176–182 72–73 flowd collector daemon, 177–182 wireless networks, 49–50, 54, 58 pfflowd tool, 182 IPv6, 24, 30, 37–38, 41, 67, 71, 73, 75, 81 setting up sensor, 176–177 NAT versus, 28–29 packet path through rule set, release of, 28 164–165 wireless networks, 49–50, 54, 56–59 to several pflog interfaces, 167 SNMP tools and MIBs, 182–183 K to syslog, 167–169 tracking statistics for each rule with KAME project, 28, 28n3 labels, 169–171 keep state flags S/SA rule, 17n3 logical NOT (!) operator, 42 keep state rules, 16–17, 17n3, 21, 26, log keyword, 162, 167 26n1, 41, 68, 188 log (m atches) clause, 164–165 kernel memory, 189–190 Knight, Joel, 183 M L MAC addresses bridges, 87 labels, 169–171 filtering, 46–47, 46n2, 60 leaf queues, 126–127 IP-based load balancing, 157–158 limit option, 189 Mac OS X, 3n3 linkshare value, 140–141 macros Linux defined, 18–19 BSD versus, 6–7 defining, 18–19 network interface naming defining local network, 29 conventions, 6 expanding into separate