Hacker News Reader

Comment by aphextron | Hacker News Reader

Pf always seemed so insanely over complicated for simple usage. It's been my one single annoyance with BSD. Are there not any good alternatives with a UFW-esque interface?

View on HN

Comparing UFW to pf is apples and oranges.

Using a more apples to apples comparison, pf is way simpler than iptables.

By bringing up UFW which is an iptables wrapper, you're not looking for a pf alternative so much as a pf wrapper. But it was the complexity of iptables that drove development of wrappers like UFW in the first place - pf doesn't really have the same level of need that iptables did.

Personally having used iptables and ipfilter I always thought pf was pretty simple.

> By bringing up UFW which is an iptables wrapper, you're not looking for a pf alternative so much as a pf wrapper. But it was the complexity of iptables that drove development of wrappers like UFW in the first place - pf doesn't really have the same level of need that iptables did.

I fully understand that Pf is equivalent to iptables, and is a lower level abstraction than UFW. But the question stands; Is there a simple foolproof utility for blocking ports on BSD with a single command? I just don't feel like whitelisting port 80 should require authoring a config file.

>Is there a simple foolproof utility for blocking ports on BSD with a single command?

Yes. It is called pf.

    block in  on fxp0  proto tcp  to any  port { 25 80 }

... blocks incoming email and http connections on the fxp0 interface. That is all you need to put in pf.conf to do that.

I agree. The syntax is very readable and easy to understand. With consumer firewalls being pwned all the time, OpenBSD with PF could be a good option for some people.

I’m going to have to get it set up again... ahh the simplicity and robustness of OpenBSD...

I recommend using `egress` in a simple setup like that, it'll still work if you ever change your network device.

    block in on egress proto tcp to port { 25, 80 }

yes, you can, the command is called 'vi' :)

    block all
    pass proto tcp to port www

I have always found Linux's iptables particularly baroque when compared with OpenBSD's pf -- the different chains (INPUT, FORWARD, OUTPUT), the different tables ("Oh, it's the _NAT_ table you're looking for"), they seemed unnecessary complexities.

My current firewall [0] has two physical interfaces, 3 additional "virtual" (VLAN-tagged) interfaces, three RFC-1918 subnets, four IPv6 subnets (dual-stack of course, except for an IPv6-only subnet) with varying degrees of security between the subnets -- and I could not imagine maintaining it with anything but pf.

[0] https://github.com/cunnie/vain.nono.io-etc/blob/master/pf.co...

I am incredulous on reading this.....

Are you really saying this[0] is more complex than this?[1][2]

If _anything_ I'm annoyed that linux doesn't have this.

[0]: https://git.drk.sc/darkscience/ds-salt/blob/master/security/...

[1]: https://git.drk.sc/darkscience/ds-salt/blob/master/security/...

[2]: https://git.drk.sc/darkscience/ds-salt/blob/master/security/...

I always loved pf’s declarative syntax.

I do not remember the name[0], unfortunately, but I vaguely recall reading about a tool that gives you a high-level interface to define firewall rules and than emits a script/config file for various packet filters.

It was a long time ago, though, and my memory may trick me. And if that tool really did exist, it might be unmaintained and outdated.

[0] I though it was called Firestarter, but that tool appears to be Linux/iptables-specific.

Well, try to use iptables by hand and not via wrappers like ufw and you will quickly realize that it's the other way around. pf's syntax is already very much like ufw's command line arguments. I guess what arguably may be missing if anything is a good, simple, thoroughly commented template to work from when first starting off.

Reply on news.ycombinator.com