Re: pf rules after crash

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEE7sBxPmxNSLEwQp4k5k1h0mWW9oAFAmDpd2gACgkQ5k1h0mWW
9oCA7Af/bivbGy6vrCgsLafZPLWf48uAsvqRrYVJK+piHHTVQ6lu3Y6CFkTdmpX4
j78n8vLplGH7U9N4O60nrwtnQUfrZDRNHfnThjy1pUDep6Rlnus7ueTcFxe8bsIM
pvhcvaJP6UOoeqZdlPlMlQSn0OJLDiMg7THHytq1e4U96nTJQ6gbD0CShPgaoZHI
0NQxXoRk1PqoSgyTY6aA9HmwwWeKRWC5Jjsl96DmDnD9L/8sQGGCOYdguZrvyNS4
ur5MP7UrqVYISWMdRvY5KTx9NHgJddSGr3okGDWc+98PJe2hSEJSRdVU5vQCubFZ
t2BrF4X3PDozVGBS3K9HBMa5qNHE4g==
=rBZD
-----END PGP SIGNATURE-----
> 10. jul. 2021 kl. 05:11 skrev Allan Streib <astreib@fastmail.fm>:
>
> Hi,
>
> I have a KVM host running OpenBSD 6.9 for a few days. It crashed today for some reason, and when I logged in and realized the uptime had changed, I checked the pf rules out of curiosity since I have been experimenting with pf. These rules are very different from what is in /etc/pf.conf.
>
> # pfctl -s rules
> block drop all
> pass out inet6 proto ipv6-icmp all icmp6-type neighbrsol
> pass out inet6 proto ipv6-icmp all icmp6-type routersol
> pass out inet6 proto udp from any port = 546 to any port = 547
> pass out inet proto icmp all icmp-type echoreq
> pass out inet proto udp from any port = 68 to any port = 67
> pass out proto tcp from any to any port = 53 flags S/SA
> pass out proto udp from any to any port = 53
> pass in inet6 proto ipv6-icmp all icmp6-type neighbradv
> pass in inet6 proto ipv6-icmp all icmp6-type routeradv
> pass in inet6 proto udp from any port = 547 to any port = 546
> pass in proto tcp from any to any port = 22 flags S/SA
> pass in inet proto udp from any port = 67 to any port = 68
> pass on lo0 all flags S/SA
> pass in proto carp all keep state (no-sync)
> pass out proto carp all !received-on any keep state (no-sync)
>

This matches the default rule set in /etc/rc.

For whatever reason your pf.conf did not parse to a valid config, so rc's own default rules were kept in place.


> # cat /etc/pf.conf
> # $OpenBSD: pf.conf,v 1.55 2017/12/03 20:40:04 sthen Exp $
> #
> # See pf.conf(5) and /etc/examples/pf.conf
> table <abusers> persist
> set skip on lo
> block in quick from <abusers>
> block return # block stateless traffic
> pass out quick inet
> pass in quick on egress proto tcp from any to any port { www, https }
> pass in on egress proto tcp to vio0 port ssh keep state \
> (max-src-conn-rate 3/10, overload <abusers> flush)
>
> I reloaded my rules (pfctl -f /etc/pf.conf) which worked, and then rebooted and checked (pfctl -s rules) which now matched the rules in /etc/pf.conf.
>
> What could explain this?

With a config that simple it is hard to say what could possibly go wrong.
I'd investigate /var/log/messages for anything unusual around the time of the event.

—
Peter N. M. Hansteen, member of the first RFC 1149 implementation team
http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/
"Remember to set the evil bit on all malicious network traffic"
delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.