Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I’m trying to configure Packet Filter on a FreeBSD server with a black-list of addresses/networks to block and a white-list of trusted users which cannot be blocked (black-listed).

Here is my first try:

table <white-list>         persist file "/etc/pf/white-list"
table <static-black-list>  persist file "/etc/pf/static-black-list"
table <dynamic-black-list> persist file "/etc/pf/dynamic-black-list"

block in all
block out all

block in log quick from { <static-black-list> <dynamic-black-list> !<white-list> }

# other rules...

(NB: there is two black-lists, the static one contains Asian networks (especially Chinese) and the dynamic addresses banned by Fail2Ban or PF itself.)

The problem is that if a white-listed IP address is also black-listed, it is blocked when it shouldn't.

Here is a simpler example:

block in quick from { 192.168.0.50 !192.168.0.50 }

The address is blocked. I tried to invert them, same result.

How can I implement this black-list / white-list system?

share|improve this question

1 Answer 1

add a pass in quick from { <white-list> } before the block rule.

or

block in from { <black-list> }

pass in quick from { <white-list> } to any port 22

share|improve this answer
    
Of course I thought about this, but this will allow all traffic from the white-listed addresses, something I don't want. I want the white-listed to comply with all rules. –  Kévin Lesénéchal Jan 14 at 12:43
    
so how about removing quick from the blacklist blocking and adding it to all the other rules. –  arved Jan 14 at 13:48
    
I don't really understand what you propose. Can you give an example? –  Kévin Lesénéchal Jan 14 at 14:12
    
Yes I see your point. And after I can use rules like pass in from { !<black-list> <white-list> } to port http, but it is very cumbersome and error-prone… Without any better solution, I will prefer the pass in quick on the white-list solution instead. –  Kévin Lesénéchal Jan 14 at 15:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.