BSDStammtisch Wien 0x04 2018-05-08

Source

Past meeting 🗓

Tuesday, 2018-05-08, 19:00 (CEST)

Location 🗺

Seminarraum Technische Informatik, Operngasse 9, 1040 Wien Public Transport: U1, U2, U4 Karlsplatz, Bus 59A Bärenmühldurchgang, Nightline N60, N62, N66, N71, Tram 2 (within reasonable walking distance) Bicycle parking: Just around the corner

Attendance 🎟

Free for all people interested in learning or discussing about all things BSD! You are welcome!

Main Topic: pf(4) routing domains

  • pf(4) and routing domains in OpenBSD
OpenBSD, pf and routing

This will apply to OpenBSD pf(4), if you want to do the same on FreeBSD, you'll likely have to chang the syntax somewhat since FreeBSD uses an older version of pf which has a different syntax.

pf is available on OpenBSD, FreeBSD, macOS, NetBSD. It's the standard packet filter, which controls packets.

Rulesets are always evaluated from top to bottom. The last rule that matches that designates the packet's destiny.

OpenBSD by default blocks the _pbuild user used to compile ports from accessing the network to ensure that ports always build even when there is no network available. Violations to that rule are always logged.

scrubbing means that fragmented packets are reassembled and TTL is enforced. It should be on at all times, though it's not required on endpoints, opposed to firewalls and routers.

Port numbers can be taken as a name as long as it exists in /etc/services and protocols as well as long as they exist in /etc/protocols.

Unlike other packet filters pf ist stateful by default. pf by default doesn't care about the IP version. When restricting a rule with an explicit IPv4 address, pf is smart enough to know that this rule can not apply to IPv6 and vice-versa.

With block or pass only the last rule is used. When using a match rule, the action is always taken, for example log. A match rule gives a packet a marker, it doesn't yet decide if the packet itself is accepted or rejected by a later rule.

quick changes the way how rules are evaluated. When a quick rule matches, it's executed immediately and no more rules get evaluated.

Rules may be restricted to ingress (in) or egress (out) traffic.

Ports can be specified as ranges, though the syntax is sometimes a little awkward.

Interfaces are transparently replaced by their current IP address. You can also dynamically reference the :network, :broadcast or :peer (point-to-point). When using dynamic IPs you can enclose the interface namen in braces like (em0) and the IP of the interface is evaluated at runtime when the rule is evaluated. Otherwise it's IP is replaced when loading he ruleset. This comes in handy with laptops that roam networks.

Lists

{tcp, udp} {http, https} Lists get expanded to a separate rules for each list item, in that order.

Macros

(aka variables) Macros allow abstraction of physical interfaces to %names. Saves a lot of headache when things change and reduces the risk of typos. Makes rules a lot more readable.

Options

skip, skips filtering on an interface (usually used on lo0) set syncookies always|never|adaptive set optimization (optimizes state timeouts) set ruleset-optimization (removes rules that never match)

Inspecting the active ruleset pfctl -s rules Evaluating a ruleset without activating it (syntax checking): pcftl -f /etc/pf.conf -n

NAT und redirection

nat-to for source nat rdr-to for incoming nat binat-to expands to nat-to and rdr-to makes 1:1 mappings. af-to for translation between different addrss families (NAT64) (only on OpenBSD, not available on FreeBSD)

Further topics
  • scrubbing
  • tables (can change during runtime, like lists of IPs, networks, etc. Daemons can build these, like spamd)
  • anchors (apply rulesets under certain conditions)
  • logging (pf logs the rule number that caused the logging)
pf, routing and rdomains

failover and load balancing Two WAN interfaces, one local network. Either for load balancing traffic or failover when one WAN goes down.

Routes and priorities failover is realized with routes of different -priority

multipath Needs to have -mpath option set.

failover typically relies on ifstated to monitor interfaces.

pf can do routing, but doesn't really want to.

routing domains

Routing domains are similar to networking namepsaces in Linux. A routing domains hat is own routes and interfaces assigned to it. By default all interfaces share a single routing domain, the default rdomain r0.

processes can be put into a rdomain and only see its routes, but not any other available routes.

A routing domain is implicitly created by assigning an interface to it. You cannot delete rdomains.

This is reflected in the output of ifconfig.

network config in /etc/hostname.<if> can be made permanent.

/etc/hostname.em1 rdomain 1 dhcp …

pair(4) devices in different rdomains. They're used to connect rdomains to one another. pair interfaces get patched to connect them. ifconfig pair1 patch pair10 ifconfig pair2 patch pair20

It's recommended to always create a loopback adresses inside the rdomains: ifconfig lo1 127.0.0.1 255.0.0.0 rdomain 1 up ifconfig lo2 127.0.0.1 255.0.0.0 rdomain 2 up

The loopback interfaces must have separate names, but each loopback does indeed have its own 127.0.0.1 address. (Unlike FreeBSD jails.)

Pair interfaces are quite new (added in OpenBSD 5.9). Before you had to route these with pf, but pf doesn't want to do routing.

rc.d daemon scripts have rtable/rdomain support via the daemon_rtable caribale. This way you can e.g. start sshd in various rdomains at startup or have specific daemins in certain rdomains.

Show and Tell

Short introductions to tools you like, or that solve a problem for you. This can be anything from GUI, CLI to Webservices, a sbook, a podcast or conference recording you'd like to recommend or a recipe for chocolate chip cookies. Mmmhhmmmm Cookies! 🍪 No need phor a phanphy prphentaishn.

Better Crypto - Applied Crypto Hardening

We're working on updates! BSD testing of settings is welcome! Better Crypto

Grazer Linuxtage

Videos are available online Media CCC

LibreSSL

LibreSSL portable breaks a bunch of ports.
- postfix - mysql 5.7

BSD Hardware monitor

https://github.com/koitsu/bsdhwmon FreeBSD pkg is very outdated. Building from source is easy, just do make. Hardware support is very limited. Basically a bunch of older Supermicro motherboards is supported. (X6-X8, nothing newer.) None of the hardware I have under my control is supported. Maybe in the future.

Drinks and Food afterwards

Chit chat, food and drinks afterwards.