[Previous: Scrub (Packet Normalization)] [Contents] [Next: Packet Queueing and Prioritization]
Sub rulesets are attached to the main ruleset by using anchors. There are four types of anchor rules:
For example:
ext_if = "fxp0"
block on $ext_if all
pass out on $ext_if all keep state
anchor goodguys
This ruleset sets a default deny policy on fxp0 for both incoming and outgoing traffic. Traffic is then statefully passed out and an anchor rule is created named goodguys. Anchors can be populated with rules by two methods:
The load rule causes pfctl to populate the specified anchor by reading rules from a text file. The load rule must be placed after the anchor rule. Example:
anchor goodguys
load anchor goodguys from "/etc/anchor-goodguys-ssh"
To add rules to an anchor using pfctl, the following type of command can be used:
# echo "pass in proto tcp from 192.0.2.3 to any port 22" \
| pfctl -a goodguys -f -
Rules can also be saved and loaded from a text file:
# cat >> /etc/anchor-goodguys-www
pass in proto tcp from 192.0.2.3 to any port 80
pass in proto tcp from 192.0.2.4 to any port { 80 443 }
# pfctl -a goodguys -f /etc/anchor-goodguys-www
Filter and translation rules can be loaded into an anchor using the same syntax and options as rules loaded into the main ruleset. One caveat, however, is that any macros that are used must also be defined within the anchor itself; macros that are defined in the parent ruleset are not visible from the anchor.
Since anchors can be nested, it's possible to specify that all child anchors within a specified anchor be evaluated:
anchor "spam/*"
This syntax causes each rule within each anchor attached to the spam anchor to be evaluated. The child anchors will be evaluated in alphabetical order but are not descended into recursively. Anchors are always evaluated relative to the anchor in which they're defined.
Each anchor, as well as the main ruleset, exist separately from the other rulesets. Operations done on one ruleset, such as flushing the rules, do not affect any of the others. In addition, removing an anchor point from the main ruleset does not destroy the anchor or any child anchors that are attached to that anchor. An anchor is not destroyed until it's flushed of all rules using pfctl(8) and there are no child anchors within the anchor.
ext_if = "fxp0"
block on $ext_if all
pass out on $ext_if all keep state
anchor ssh in on $ext_if proto tcp from any to any port 22
The rules in the anchor ssh are only evaluated for TCP packets destined for port 22 that come in on fxp0. Rules are then added to the anchor like so:
# echo "pass in from 192.0.2.10 to any" | pfctl -a ssh -f -
So, even though the filter rule doesn't specify an interface, protocol, or port, the host 192.0.2.10 will only be permitted to connect using SSH because of the anchor rule's definition.
To list all the rules in the anchor named ssh:
# pfctl -a ssh -s rules
To flush all filter rules from the same anchor:
# pfctl -a ssh -F rules
For a full list of commands, please see pfctl(8).
[Previous: Scrub (Packet Normalization)] [Contents] [Next: Packet Queueing and Prioritization]