# pf question about rules



## wonslung (Nov 12, 2009)

I was wondering if theres a way to load rules dynamically when they are needed.


Let's say you have xbox live and you want to load the nat rules for it but only when the xbox is actually on.  I've read how to load rules with an anchor on this site: https://calomel.org/pf_config.html

but if i understand that correctly i would need to load them each time manually.  Is there any way to load them automatically?  I don't exactly like the idea of uPnP but if there was a way to set it to ONLY allow SPECIFIC rules from specific hosts...then it might not be so bad.


----------



## SirDice (Nov 12, 2009)

wonslung said:
			
		

> I was wondering if theres a way to load rules dynamically when they are needed.



http://www.openbsd.org/faq/pf/anchors.html



> Let's say you have xbox live and you want to load the nat rules for it but only when the xbox is actually on.  I've read how to load rules with an anchor on this site: https://calomel.org/pf_config.html
> 
> but if i understand that correctly i would need to load them each time manually.  Is there any way to load them automatically?  I don't exactly like the idea of uPnP but if there was a way to set it to ONLY allow SPECIFIC rules from specific hosts...then it might not be so bad.


With net/miniupnpd you have quite a lot of control. It's really easy to see which rules are loaded.


----------



## wonslung (Nov 12, 2009)

so you can set it to only allow...say, xbox from a specific ip?
i couldnt' find any howto's for miniupnpd

also, i read the anchor thing..but i was confused....mainly by the post i linked...it sounds like it will only work if i load it manually...

I guess miniupnpd would be fine if it has a config file which will allow me to be specific about what i'll allow.


----------



## SirDice (Nov 12, 2009)

Miniupnpd uses anchors 

`# pfctl -a miniupnpd -s rules`
`# pfctl -a miniupnpd -s nat`
Shows the specific rules/nat lines, this makes it relatively easy to keep an eye on it.

Because miniupnpd uses anchors you can put them in your config where you want them. If you get a little creative you can block UPnP traffic (5000/1900 udp/tcp) from certain hosts while allowing others.


----------



## wonslung (Nov 12, 2009)

SirDice said:
			
		

> Miniupnpd uses anchors
> 
> `# pfctl -a miniupnpd -s rules`
> `# pfctl -a miniupnpd -s nat`
> ...



ahh, ok...but theres no way to just dynamically load a specific rule set "on the fly"?

as a fallback miniupnp sounds ok i guess...

ideally i'd like to be able to have a way that can detect that packets are moving to the xbox and automatically load the rules to allow xbox live, then when they stop, flush the rules..

but worst case i'll either do what you suggest or just set the rules on all the time...


----------



## SirDice (Nov 12, 2009)

wonslung said:
			
		

> ahh, ok...but theres no way to just dynamically load a specific rule set "on the fly"?


Not sure what you are planning but you can load a different ruleset at any time, for example:
`# pfctl -f /etc/pf.xbox.conf`
This will load a complete ruleset named pf.xbox.conf

Or you can use anchors to add/remove additional rules:
`# pfctl -a xbox -f /etc/pf.xbox.conf`
This will load additional rules in an existing ruleset at the xbox anchor.



> but worst case i'll either do what you suggest or just set the rules on all the time...


I don't have an xbox but I know messenger on Windows likes having UPnP


----------



## wonslung (Nov 13, 2009)

SirDice said:
			
		

> Not sure what you are planning but you can load a different ruleset at any time, for example:
> `# pfctl -f /etc/pf.xbox.conf`
> This will load a complete ruleset named pf.xbox.conf
> 
> ...






I Know i can load a ruleset at any time.  I don't want to HAVE to load it. Ideally, i would like to set up some kind of daemon that looks for the client with an ip 192.168.1.10 or mac address
xx:xx:xx:xx whatever to try to make a connection.  When this client becomes active, then load rules for xbox live.

When it is not active, flush the rules.

I guess this isn't possible.  What would be nice is a way to have upnp with a config to only allow specific host to access a specific port/ports or a way to dynamically load the rules when they are needed and automatically flush them when they aren't

I'm sure it's possible with some sort of clever rules and trickery. I know i can't be the only one who wants this type of a feature.


----------



## Ruler2112 (Nov 13, 2009)

What's the point of doing something like what you suggest?  If the xbox is off, it's not going to have traffic and the rules for it won't hurt anything.  (I'm not trying to be a jerk, but am genuinely curious.)

Is the xbox connected to the bsd box via it's own interface or via a switch/hub?  If by it's own interface, you could write a daemon to watch the log files for a message indicating that the state of the line has changed and fire the appropriate pfctl commands based on that.  There may also be a trigger already present to activate on such an event; I don't know.


----------



## SirDice (Nov 13, 2009)

wonslung said:
			
		

> I'm sure it's possible with some sort of clever rules and trickery. I know i can't be the only one who wants this type of a feature.


Something like this would probably do the trick:

```
xbox="192.168.1.123"

block in quick on $lan_if from !$xbox to any port 1900 
block in quick on $lan_if from !$xbox to any port 5000

anchor "miniupnpd"
```

The 2 block statements will block any UPnP traffic except from the xbox.


----------



## wonslung (Nov 13, 2009)

thanks, can you also do something like

```
block in quick on $lan_if from !{$xbox, $xbox2} to any port 1900 
block in quick on $lan_if from !{$xbox, $xbox2} to any port 5000
```


----------



## DutchDaemon (Nov 13, 2009)

Please use 
	
	



```
tags!
```


----------



## wonslung (Nov 13, 2009)

DutchDaemon said:
			
		

> Please use
> 
> 
> 
> ...


----------



## SirDice (Nov 13, 2009)

wonslung said:
			
		

> thanks, can you also do something like
> 
> ```
> block in quick on $lan_if from !{$xbox, $xbox2} to any port 1900
> ...



It'll be easier to do:

```
xboxes="{192.168.1.123, 192.168.1.124}"
```
Then use $xboxes, but yeah, yours should also work.


----------



## wonslung (Nov 14, 2009)

SirDice said:
			
		

> It'll be easier to do:
> 
> ```
> xboxes="{192.168.1.123, 192.168.1.124}"
> ...



cool, i like yours better.
thanks again for all the help.  I think i'm going to pull the trigger on this thing tonight.


----------

