os/doc
3
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Finish subsection on enabling PF.

Browse source 
Comment out pfsync section for now as it is no longer true. At some point
a section should be adding demonstrating how to use it.

Sponsored by: iXsystems
This commit is contained in:
Dru Lavigne 2014-02-14 01:30:43 +00:00
parent ce530d1d37
commit ae82b2aa02
Notes: svn2git 2020-12-08 03:00:23 +00:00 
svn path=/head/; revision=43916
1 changed files with 33 additions and 26 deletions

59
en_US.ISO8859-1/books/handbook/firewalls/chapter.xml
View file

@ -232,24 +232,27 @@
<sect2>
<title>Enabling <application>PF</application></title>
<para>In order to use <application>PF</application>, its module must be first
loaded. Add the following line to
<para>In order to use <application>PF</application>, its kernel module must be first
loaded. This section describes the entries that can be added
to <filename>/etc/rc.conf</filename> in order to enable
<application>PF</application>.</para>
<para>Start by adding the following line to
<filename>/etc/rc.conf</filename>:</para>
<programlisting>pf_enable="YES"</programlisting>
<para>Additional options can be passed to
<application>PF</application> when it is started. Refer to
&man.pfctl.8; for the available options and specify any
required flags by
adding another entry to <filename>/etc/rc.conf</filename>:</para>
<para>Additional options, described in &man.pfctl.8;, can be passed to
<application>PF</application> when it is started. Add this entry to
<filename>/etc/rc.conf</filename> and specify any
required flags between the two quotes (<literal>""</literal>):</para>
<programlisting>pf_flags="" # additional flags for pfctl startup</programlisting>
<para>The module will not load if it cannot find the
ruleset configuration file. A default ruleset is located
<filename>/etc/pf.conf</filename>. If a custom ruleset is
located somewhere else, add a line to
<para><application>PF</application> will not start if it cannot find its
ruleset configuration file. The default ruleset is already created and is named
<filename>/etc/pf.conf</filename>. If a custom ruleset has
been saved somewhere else, add a line to
<filename>/etc/rc.conf</filename> which specifies the full
path to the file:</para>
@ -260,33 +263,35 @@
<filename>/usr/share/examples/pf/</filename>. The rest of
this chapter demonstrates how to create a custom ruleset.</para>
<para>Then, run the startup script to load the module:</para>
<screen>&prompt.root; <userinput>service pf start</userinput></screen>
<para>Logging support for <application>PF</application> is provided by
&man.pflog.4; which can be loaded by adding the
following line to <filename>/etc/rc.conf</filename>:</para>
&man.pflog.4;. To enable logging support, add this
line to <filename>/etc/rc.conf</filename>:</para>
<programlisting>pflog_enable="YES"</programlisting>
<para>The following &man.rc.conf.5; statements can also be used to
<para>The following lines can also be added in order to
change the default location of the log file or to specify any
additional flags:</para>
additional flags to pass to &man.pflog.4; when it is started:</para>
<programlisting>pflog_logfile="/var/log/pflog" # where pflogd should store the logfile
pflog_flags="" # additional flags for pflogd startup</programlisting>
<para>Save the edits, then run the startup script to load the logging module:</para>
<screen>&prompt.root; <userinput>service pflog start</userinput></screen>
<para>If there is a <acronym>LAN</acronym> behind the firewall and packets need to
<para>Finally, if there is a <acronym>LAN</acronym> behind the firewall and packets need to
be forwarded for the computers on the <acronym>LAN</acronym>, or <acronym>NAT</acronym> is required,
add the following option:</para>
<programlisting>gateway_enable="YES" # Enable as LAN gateway</programlisting>
<indexterm>
<para>After saving the needed edits,
<application>PF</application> can be started with logging support by typing:</para>
<screen>&prompt.root; <userinput>service pf start</userinput>
&prompt.root; <userinput>service pflog start</userinput></screen>
<!--
This is no longer true as of 9.x. It also references the CARP section
which doesn't explain how to use it...At some point it should.
<indexterm>
<primary>kernel options</primary>
<secondary>device pf</secondary>
</indexterm>
@ -304,8 +309,7 @@ pflog_flags="" # additional flags for pflogd startup</programli
<note>
<para>While it is not necessary to compile
<application>PF</application> support into the &os; kernel,
some of PF's advanced features are not included in the
loadable module, namely &man.pfsync.4;, which is a
some advanced features are not included, namely &man.pfsync.4;, which is a
pseudo-device that exposes certain changes to the state table
used by <application>PF</application>. It can be paired with
&man.carp.4; to create failover firewalls using
@ -319,6 +323,8 @@ pflog_flags="" # additional flags for pflogd startup</programli
device pflog
device pfsync</programlisting>
<para>where:</para>
<para><literal>device pf</literal> enables PF support.</para>
<para><literal>device pflog</literal> enables the optional
@ -331,6 +337,7 @@ device pfsync</programlisting>
&man.pfsync.4; pseudo-network device that is used to monitor
<quote>state changes</quote>.</para>
</note>
-->
</sect2>
<sect2>