Home / server / Questions / 374713
Accepted
Earlz
Asked: 2012-03-29 23:27:58 +0800 CST

How to configure something like "Reflexive ACL" on OpenBSD?

  • 772

My U-Verse modem has something called "Reflexive ACL" described as

Reflexive ACL: When IPv6 is enabled, you can enable Reflexive Access Control Lists to deny inbound IPv6 traffic unless this traffic results from returning outgoing packets (except as configured through firewall rules).

This seems like a pretty good way to keep from having to maintain a firewall on each computer behind my router that gets handed an IPv6 address. It sounds about like a NAT, which for my small home network is all I want right now.

Now my modem sucks as a router though, so I'm in the process of configuring an OpenBSD router to do that. I've got IPv6 supported and all that and my OpenBSD router will hand out IPv6 addresses by rtadvd. Now I want to keep people from having instant access to my local network through IPv6.

How would I best do something like Reflexive ACL with pf in OpenBSD 5.0?

firewall openbsd ipv6 pf

2 Answers

  1. Best Answer

    This will do:

    pass on $int_if all
pass out on $ext_if all
block in on $ext_if all

    This will pass all traffic except on the external interface where it will drop all incoming packets. OpenBSD is stateful by default, so it will allow packets in if it matches an existing connection.

    • 1

  2. That sounds like stateful filtering to me.

    The OpenBSD pf.conf man page says the following about keeping state:

    By default pf(4) filters packets statefully: the first time a packet matches a pass rule, a state entry is created. The packet filter examines each packet to see if it matches an existing state. If it does, the packet is passed without evaluation of any rules. After the connection is closed or times out, the state entry is automatically removed.

    pf will keep state by default.

    • 0