# Is there some way to monitor what's happening in PF?



## mariourk (Jun 4, 2012)

I want to block any traffic from em3 to em1, to completely seperate these networks. But no matter what I try, I can't make it work. And I don't understand why. Is there some way to follow what's happening in PF, so I can see why it's allowing traffic I want to block?


----------



## bbzz (Jun 4, 2012)

It would've been more helpful if you explained what exactly are you trying to do, and how so far you tried to do it. PF's *pflog* interface allows you to monitor trough logging, among other things.


----------



## kpa (Jun 4, 2012)

Enable pflog(4) in /etc/rc.conf


```
pflog_enable="YES"
```
You might want to lower the flush time of the buffer that defaults to 60 seconds to lower value so you don't have to wait for a full minute to see what got logged

```
pflog_flags="-d 10"
```

Start the logger:
`# service pflog start`

Use tcpdump(1) on the log file (the log file is binary so it's not directly readable)

`# tcpdump -n -tttt -e -r /var/log/pflog`

To match the rule numbers reported in the log to rules use pfctl(8):
`# pfctl -sr -gv`

To see active states use:
`# pfctl -ss -v`

Hope this helps.


----------



## mariourk (Jun 4, 2012)

bbzz said:
			
		

> It would've been more helpful if you explained what exactly are you trying to do, and how so far you tried to do it. PF's *pflog* interface allows you to monitor trough logging, among other things.



My FreeBSD machine is connected to multiple networks and acts a a router/gateway between them. I want to block any traffic from em3 to em0, so it's impossible to connect to anything on the em0_network, from the em3_network.

I tried several rules, like this one.

```
block out quick log on $em3_if from $em3_if to $em0_if
```

The syntax is correct and it should work. But I'm still able to connect to hosts on the em0_network, from em3_network. When I log this rule, I see nothing appear in the logs, so apparently it's not triggered.


----------



## kpa (Jun 4, 2012)

The macros $emx_if expand to single addresses so you're only blocking traffic originating from interface $em3_if itself, you need to use $em3_if:network to specify the whole network connected to interface
$em3_if.

I would block on incoming traffic, like this:


```
block in quick log on $em3_if from $em3_if:network to $em0_if:network
```


----------



## bbzz (Jun 4, 2012)

mariourk said:
			
		

> ```
> block out quick log on $em3_if from $em3_if to $em0_if
> ```
> 
> The syntax is correct and it should work.



No it isn't. It should be *block in* on your em3 interface, since this is how packets enter router.


----------



## mariourk (Jun 5, 2012)

Changing block out to block in and adding :network did the trick.

Thanks!


----------

