Can someone help me convert iptable rules to freebsd pf rules. I have already tried fwbuilder, but without success. It seems that some rules can not be ported, and other seem to be logically different. I want to port following:

1) -A INPUT -p icmp -m limit --limit 5/sec -j ACCEPT -A INPUT -p icmp -f -j DROP -A INPUT -p icmp -j DROP

Problem with pf is that it seems there is no flag for rate of received packages. There is only flag for connection rate. Another problem is that in pf I can't drop fragmented packets.

2) -A INPUT -m pkttype --pkt-type broadcast -j DROP -A INPUT -m addrtype --dst-type BROADCAST -j DROP -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i ETH3 -p tcp -m tcp --dport 2576 -m limit --limit 50/sec --limit-burst 100 -j ACCEPT -A INPUT -i ETH3 -p tcp -m tcp --dport 2576 -m recent --set --name DEFAULT --mask --rsource -A INPUT -i ETH3 -p tcp -m tcp --dport 2576 -m recent --update --seconds 5 --hitcount 200 --name DEFAULT --mask --rsource -j DROP

Problem with pf is that I can't match MAC broadcast messsages. Also on pf is possible to detect host that tries to connect with high connection rate and to put it table with banned host. The problem is that the host can't be removed from table. So if host is recognized as bad host, it can't ever be trusted again(and messages from that host will be dropped). Another issue is that pf messages doesn't have states, e.g. RELATED and ESTABLISHED.

  • You are too quick with the claims ( 1)no flag for rate of received packages 2)only flag for connection rate 3)can't drop fragmented packets 4)can't match MAC broadcast messsages 5)host can't be removed from table 6)pf messages doesn't have states). There are no short responds. You might want review TOC of Book of PF. In addition to this there is lot of cooperating tools: blacklistd, fail2ban, sshguard, ... – Vladimir Botka Feb 28 at 22:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.