PF.BOOT.CONF(5)

📦 version 11.0, in nixpkgs unstable

💅 PF.BOOT.CONF(5) — file formats manual, but make it a whole vibe ✨

Okay bestie, welcome to the pf.boot.conf(5) page. No cap, this is the manual for the packet filter’s little pre-game setup, and it’s lowkey iconic. 🫶

🌸 NAME 🌸

pf.boot.conf — the initial configuration for packet filter, bestie.

✨ DESCRIPTION ✨

So the pf.boot.conf file is used as initial configuration for the pf(4) packet filter. It gets loaded before the network is configured by the rc.d(8) script network. The whole point? Protect the machine from possible attacks that could happen between the network configuration and the loading of the final ruleset. It’s giving “security guard who shows up early.” 💅

The syntax of this file is described in pf.conf(5). Go read that for the grammar situation, iykyk. 🦋

🚨 Heads up, bestie: at the stage the configuration is loaded, the network interface(s) do not have an IP address yet. So you cannot use rules that derive addresses from an interface — for example: pass out from any to fxp0. Literally not available at that point. 😭

🎀 FILES 🎀

  • /etc/defaults/pf.boot.conf — default initial ruleset file.
  • /etc/pf.boot.conf — override of the default initial ruleset file.

🧚 EXAMPLES 🧚

When using NFS (e.g. diskless situations), you’ll also need the following rules in addition to the default rules to unblock NFS:

scrub in all no-df
pass in proto udp from any port { 111, 2049 } to any
pass out proto udp from any to any port { 111, 2049 }

🔥 SEE ALSO 🔥

🫶 Sign-off bestie: source/version is Debian, date is August 17, 2005 — protect that machine and slay, bye! 💖
📦 where this page comes from