Control the packet filter (PF) and network address translation (NAT) device
pfctl [-AdeghmNnOoqRrvz] [-a anchor] [-D macro=value] [-F modifier ] [-f file] [-i interface] [-k host] [-p device] [-s modifier] [-t table -T command [address ...]] [-x level] [-y rule_num]
QNX Neutrino
Anchors are referenced by name and may be nested, with the various components of the anchor path separated by slashes (/), similar to how file system hierarchies are laid out. The last component of the anchor path is where rule-set operations are performed.
Evaluation of anchor rules from the main rule set is described in the documentation for pf.conf.
Private tables can also be put inside anchors, either by having table statements in the pf.conf file that is loaded in the anchor, or by using regular table commands, as in:
pfctl -a foo/bar -t mytable -T add 1.2.3.4 5.6.7.8
When a rule referring to a table is loaded in an anchor, the rule will use the private table if one is defined, and then fall back to the table defined in the main rule set, if there is one. This is similar to C rules for variable scope. It is possible to create distinct tables with the same name in the global rule set and in an anchor, but this is often bad design, and a warning is issued in that case.
Specify - for the file to use standard input.
pfctl -k host
To kill all of the state entries from host1 to host2:
pfctl -k host1 -k host2
echo "set loginterface fxp0" | pfctl -mf -
You can specify a second -o option to use the currently loaded rule set as a feedback profile to tailor the optimization of the quick rules to the actual network behavior.
io-pkt-v4-hc -d abc100 pci=0x0 io-pkt-v4-hc -i1 -d abc100 pci=0x1 -ptcpip prefix=/sock2
You can use the SOCK environment variable and the -p option to direct pfctl to work with the second instance of io-pkt like this:
SOCK=/sock2 pfctl -p /sock2/dev/pf...
For more information, see Running multiple instances of the TCP/IP stack in the TCP/IP Networking chapter of the QNX Neutrino User's Guide.
Note that the skip step optimization done automatically by io-pkt skips the evaluation of rules where possible. Packets passed statefully are counted in the rule that created the state (even though the rule isn't evaluated more than once for the entire connection).
pfctl -Tl -f pf.conf
For the add, delete, replace, and test commands, you can specify the list of addresses either directly on the command line and/or in an unformatted text file, using the -f flag. Comments starting with a # are allowed in the text file. With these commands, you can also use the -v option once or twice, in which case pfctl prints the detailed result of the operation for each individual address, prefixed by one of the following letters:
Each table maintains a set of counters that you can retrieve using the -v option. For example, the following commands define a wide-open firewall that keeps track of packets going to or coming from the OpenBSD FTP server. The following commands configure the firewall and send 10 pings to the FTP server:
printf "table <test> { ftp.NetBSD.org }\n \ pass out to <test> keep state\n" | pfctl -f- ping -qc10 ftp.NetBSD.org
We can now use the table show command to output, for each address and packet direction, the number of packets and bytes that are being passed or blocked by rules referencing the table. The time at which the current accounting started is also shown with the Cleared line:
pfctl -t test -vTshow 129.128.5.191 Cleared: Thu Feb 13 18:55:18 2003 In/Block: [ Packets: 0 Bytes: 0 ] In/Pass: [ Packets: 10 Bytes: 840 ] Out/Block: [ Packets: 0 Bytes: 0 ] Out/Pass: [ Packets: 10 Bytes: 840 ]
Similarly, you can view global information about the tables by using the -v option twice with the -s Tables command. This displays the number of addresses on each table, the number of rules that reference the table, and the global packet statistics for the whole table:
pfctl -vvsTables --a-r- test Addresses: 1 Cleared: Thu Feb 13 18:55:18 2003 References: [ Anchors: 0 Rules: 1 ] Evaluations: [ NoMatch: 3496 Match: 1 ] In/Block: [ Packets: 0 Bytes: 0 ] In/Pass: [ Packets: 10 Bytes: 840 ] In/XPass: [ Packets: 0 Bytes: 0 ] Out/Block: [ Packets: 0 Bytes: 0 ] Out/Pass: [ Packets: 10 Bytes: 840 ] Out/XPass: [ Packets: 0 Bytes: 0 ]
In this case, only one packet—the initial ping request—matched the table, but all packets passing as the result of the state are correctly accounted for. Reloading the table(s) or ruleset doesn't affect packet accounting in any way. The two XPass counters are incremented instead of the Pass counters when a stateful packet is passed but doesn't match the table anymore. This will happen in our example if someone were to flush the table while the ping command was running.
When used with a single -v, pfctl displays only the first line containing the table flags and name. The flags are defined as follows:
The pfctl utility communicates with the packet filter device using the ioctl() or ioctl_socket() interface described in pf. It lets you configure rule sets and parameters and retrieve status information from the packet filter.
Packet filtering restricts the types of packets that pass through network interfaces entering or leaving the host based on filter rules as described in pf.conf. The packet filter can also replace addresses and ports of packets. Replacing source addresses and ports of outgoing packets is called NAT (Network Address Translation) and is used to connect an internal network (usually reserved address space) to an external one (the Internet) by making all connections to external hosts appear to come from the gateway. Replacing destination addresses and ports of incoming packets is used to redirect connections to different hosts and/or ports. A combination of both translations, bidirectional NAT, is also supported. Translation rules are described in the documentation for pf.conf.
The packet filter doesn't itself forward packets between interfaces. Forwarding can be enabled by setting the sysctl variables net.inet.ip.forwarding and/or net.inet6.ip6.forwarding to 1. Set them permanently in a file such as /etc/sysctl.conf, and then start sysctl using that file. For example:
sysctl -f /etc/sysctl.conf