[Previous: Address Pools and Load Balancing] [Contents] [Next: Logging]

PF: Packet Tagging (Policy Filtering)

Table of Contents

• Introduction
• Assigning Tags to Packets
• Checking for Applied Tags
• Policy Filtering
• Tagging Ethernet Frames

Introduction

Assigning Tags to Packets

pass in on $int_if all tag INTERNAL_NET keep state

The tag INTERNAL_NET will be added to any packet which matches the above rule.

A tag can also be assigned using a macro. For instance:

name = "INTERNAL_NET"
pass in on $int_if all tag $name keep state

There are a set of predefined macros which can also be used.

• $if - The interface
• $srcaddr - Source IP address
• $dstaddr - Destination IP address
• $srcport - The source port specification
• $dstport - The destination port specification
• $proto - The protocol
• $nr - The rule number

These macros are expanded at ruleset load time and NOT at runtime.

Tagging follows these rules:

• Tags are "sticky". Once a tag is applied to a packet by a matching rule it is never removed. It can, however, be replaced with a different tag.
• Because of a tag's "stickiness", a packet can have a tag even if the last matching rule doesn't use the tag keyword.
• A packet is only ever assigned a maximum of one tag at a time.
• Tags are internal identifiers. Tags are not sent out over the wire.
• Tag names can be up to 63 characters long. In OpenBSD 4.0 and earlier, tag names are limited to 15 characters.

Take the following ruleset as an example.

(1) pass in on $int_if tag INT_NET keep state
(2) pass in quick on $int_if proto tcp to port 80 tag \
        INT_NET_HTTP keep state
(3) pass in quick on $int_if from 192.168.1.5 keep state

• Packets coming in on $int_if will be assigned a tag of INT_NET by rule #1.
• TCP packets coming in on $int_if and destined for port 80 will first be assigned a tag of INT_NET by rule #1. That tag will then be replaced with the INT_NET_HTTP tag by rule #2.
• Packets coming in on $int_if from 192.168.1.5 will be tagged one of two ways. If the packet is destined for TCP port 80 it will match rule #2 and be tagged with INT_NET_HTTP. Otherwise, the packet will match rule #3 but will be tagged with INT_NET. Because the packet matches rule #1, the INT_NET tag is applied and is not removed unless a subsequently matching rule specifies a tag (this is the "stickiness" of a tag).

In addition to applying tags with filter rules, the nat, rdr, and binat translation rules can also apply tags to packets by using the tag keyword.

Checking for Applied Tags

pass out on $ext_if tagged INT_NET keep state

Outgoing packets on $ext_if must be tagged with the INT_NET tag in order to match the above rule. Inverse matching can also be done by using the ! operator:

pass out on $ext_if ! tagged WIFI_NET keep state

Translation rules (nat/rdr/binat) can also use the tagged keyword to match packets.

Policy Filtering

• Traffic from the internal LAN to the Internet is permitted (LAN_INET) and must be translated (LAN_INET_NAT)
• Traffic from the internal LAN to the DMZ is permitted (LAN_DMZ)
• Traffic from the Internet to servers in the DMZ is permitted (INET_DMZ)
• Traffic from the Internet that's being redirected to spamd(8) is permitted (SPAMD)
• All other traffic is blocked

Note how the policy covers all traffic that will be passing through the firewall. The item in parenthesis indicates the tag that will be used for that policy item.

Filter and translation rules now need to be written to classify packets into the policy.

rdr on $ext_if proto tcp from <spamd> to port smtp \
   tag SPAMD -> 127.0.0.1 port 8025
nat on $ext_if tag LAN_INET_NAT tagged LAN_INET -> ($ext_if)

block all
pass in on $int_if from $int_net tag LAN_INET keep state
pass in on $int_if from $int_net to $dmz_net tag LAN_DMZ keep state
pass in on $ext_if proto tcp to $www_server port 80 tag INET_DMZ keep state

Now the rules that define the policy are set.

pass in  quick on $ext_if tagged SPAMD keep state
pass out quick on $ext_if tagged LAN_INET_NAT keep state
pass out quick on $dmz_if tagged LAN_DMZ keep state
pass out quick on $dmz_if tagged INET_DMZ keep state

Now that the whole ruleset is setup, changes are a matter of modifying the classification rules. For example, if a POP3/SMTP server is added to the DMZ, it will be necessary to add classification rules for POP3 and SMTP traffic, like so:

mail_server = "192.168.0.10"
...
pass in on $ext_if proto tcp to $mail_server port { smtp, pop3 } \
   tag INET_DMZ keep state

Email traffic will now be passed as part of the INET_DMZ policy entry.

The complete ruleset:

Tagging Ethernet Frames

# brconfig bridge0 rule pass in on fxp0 src 0:de:ad:be:ef:0 \
   tag USER1

And then in pf.conf:

pass in on fxp0 tagged USER1

[Previous: Address Pools and Load Balancing] [Contents] [Next: Logging]