Rule options for PF policy rules

Tab General

Stateless rule

Firewall Builder always uses stateful packet inspection if it is available in the target firewall. In case of PF, this means using "keep state" option for PF 3.x. In PF 4.x, combination "flags S/SA keep state" is the default so fwbuilder does not add it explicitly to the generated pf configuration. However, sometimes it might be desirable to create a rule without state matching. Checking this checkbox on makes the rule stateless and forces compiler to add "no state" clause to the generated pf configuration line.

Add 'keep state'

In PF 4.x, "flags S/SA keep state" is the default. Compiler will omit these flags while generating code for stateful rules matching TCP services. However, according to the PF FAQ, care should be taken while dealing with states and interface enc0. To avoid leaking unencrypted traffic out, the FAQ recommends setting 'keep state' explicitly in all rules on the enc0 interface. This option applies only if version is set to 4.x.


Tab Logging

Log prefix

This option translates into "label " in the generated pf configuration. Firewall Builder supports the following macros in the log prefix that are expanded at the compile time:


Tab Tracking

Activate source tracking

This checkbox enables using max-src-nodes and max-src-states options that can be configured using other elements in this page of the dialog.

Maximum number of source addresses...

This option translates into max-src-nodes parameter. It limits the maximum number of source addresses which can simultaneously have state table entries.

Maximum number of simultaneous state entries...

This option translates into max-src-states parameter. It limits the maximum number of simultaneous state entries that a single source address can create with this rule.


Tab Limits

Maximum number of concurrent states...

This parameter translates into "max <number>". It limits the number of concurrent states the rule may create. When this limit is reached, further packets that would create state will not match this rule until existing states time out.

Maximum number of simultaneous TCP connections...

This parameter translates into "max-src-conn <number>". It limits the maximum number of simultaneous TCP connections which have completed the 3-way handshake that a single host can make.

The limit of new connections over a time interval ... / ... sec

These parameters translate into "max-src-conn-rate <number> / <seconds>". They limit the rate of new connections over a time interval. The connection rate is an approximation calculated as a moving average.

Overload table

this parameter translates into "overload" in the generated pf configuration and can be used to create a table with given name. Source IP addresses which hit either of the limits on established connections will be added to the named table. This table can be used in the ruleset to block further activity from the offending host, redirect it to a tarpit process, or restrict its bandwidth.

To use this table in the rules, create Address Table object with the same name and leave the file name in that object blank. Then use this object in policy rules of the firewall as usual.


Tab TCP

Modulate state

When this checkbox is checked, it makes compiler add "modulate state" clause to generated pf configuration.

This option makes pf randomize TCP initial sequence numbers (ISN) of the TCP sessions opened through the firewall, thus improving protection against ISN guessing attacks. See man page for pf.conf for more details.

synproxy

This parameter translates to the "synproxy" option in generated pf configuration. The synproxy state option can be used to cause pf itself to complete the handshake with the active endpoint, perform a handshake with the passive endpoint, and then forward packets between the endpoints. See man page for pf.conf for more details.

Use sloppy TCP state tracker for this rule

This parameter translates into "sloppy" parameter in generated pf configuration. From pf.conf man page:

This makes pf use sloppy TCP connection tracker that does not check sequence numbers at all, which makes insertion and ICMP teardown attacks way easier. This is intended to be used in situations where one does not see all packets of a connection, e.g. in asymmetric routing situations. Cannot be used with modulate or synproxy state.