|How To...||Why not..?||Scripts|
Last update: 2019-09-25
In this post I show you how you can save and restore pf(4) tables. This is useful to preserve the content of dynamically built tables during reboots of OpenBSD.
The one table I use on all my exposed systems running OpenBSD
<bruteforce>. Two rules in pf.conf
make sure the table is well populated:
# Drop all traffic from bad IPs block drop in quick on egress from <bruteforce> to any # Allow SSH but catch the bad IPs pass in log on egress inet proto tcp from any to egress port ssh \ (max-src-conn 5 max-src-conn-rate 5/10 overload <bruteforce> flush global)
One way to save the table for pf(4) is to run a cronjob as root that
does the saving for you. But I prefer to save the table during the
shutdown of the system. That is what rc.shutdown
is for. My
/etc/rc.shutdown looks like this:
pfctl -t bruteforce -T show > /etc/pf.bruteforce chmod 600 /etc/pf.bruteforce
The command writes the content of the table
<bruteforce> to the file
/etc/pf.bruteforce during the shutdown of the system.
/etc/pf.conf you can add one or more
file directives to the table
table <bruteforce> file "/etc/pf.bruteforce"
This makes pf(4) load the contents of the file
/etc/pf.conf gets (re)loaded. pf(4)
will add the entries, not replace the existing content of the table.