Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I’m trying to configure Packet Filter on a FreeBSD server with a black-list of addresses/networks to block and a white-list of trusted users which cannot be blocked (black-listed).

Here is my first try:

table <white-list>         persist file "/etc/pf/white-list"
table <static-black-list>  persist file "/etc/pf/static-black-list"
table <dynamic-black-list> persist file "/etc/pf/dynamic-black-list"

block in all
block out all

block in log quick from { <static-black-list> <dynamic-black-list> !<white-list> }

# other rules...

(NB: there is two black-lists, the static one contains Asian networks (especially Chinese) and the dynamic addresses banned by Fail2Ban or PF itself.)

The problem is that if a white-listed IP address is also black-listed, it is blocked when it shouldn't.

Here is a simpler example:

block in quick from { 192.168.0.50 !192.168.0.50 }

The address is blocked. I tried to invert them, same result.

How can I implement this black-list / white-list system?

share|improve this question

add a pass in quick from { <white-list> } before the block rule.

or

block in from { <black-list> }

pass in quick from { <white-list> } to any port 22

share|improve this answer
    
Of course I thought about this, but this will allow all traffic from the white-listed addresses, something I don't want. I want the white-listed to comply with all rules. – Kévin Lesénéchal Jan 14 '14 at 12:43
    
so how about removing quick from the blacklist blocking and adding it to all the other rules. – arved Jan 14 '14 at 13:48
    
I don't really understand what you propose. Can you give an example? – Kévin Lesénéchal Jan 14 '14 at 14:12
    
Yes I see your point. And after I can use rules like pass in from { !<black-list> <white-list> } to port http, but it is very cumbersome and error-prone… Without any better solution, I will prefer the pass in quick on the white-list solution instead. – Kévin Lesénéchal Jan 14 '14 at 15:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .