IP Filter Documentation.

[Sioux C. Queue]

The FAQ at OpenSUSE is a fine document. On the page
www.openbsd.org/faq/pf/tables.html I found this "or the self keyword". On the
page www.openbsd.org/faq/pf/filter.html I found this "table <firewall> const {
self }". And finally, I think, at www.openbsd.org/faq/pf/nat.html there's this
"The word self will appear if the state is floating". All of which are nice.
What exactly is "self"? The computer has two NICs, which one is "self"? Is it
context dependent? Along that same line, where can I find a list, with a
definition, of "keywords" for IP Filter? They're mentioned a lot.

Any and all help would be appreciated.

[Peter N. M. Hansteen]

"Sioux C. Queue" <***@have.it> writes:

> The FAQ at OpenSUSE is a fine document. On the page
> www.openbsd.org/faq/pf/tables.html I found this "or the self keyword". On the
> page www.openbsd.org/faq/pf/filter.html I found this "table <firewall> const {
> self }". And finally, I think, at www.openbsd.org/faq/pf/nat.html there's this
> "The word self will appear if the state is floating". All of which are nice.
> What exactly is "self"? The computer has two NICs, which one is "self"? Is it
> context dependent? Along that same line, where can I find a list, with a
> definition, of "keywords" for IP Filter? They're mentioned a lot.
>
> Any and all help would be appreciated.

Your references to OpenSUSE and IP Filter had me a bit confused.

In PF configuration, the keyword 'self' expands to all addresses
assigned to all interfaces on the host (as a man pf.conf and search for
self would have told you).

- Peter

--
Peter N. M. Hansteen, member of the first RFC 1149 implementation team
http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/
"Remember to set the evil bit on all malicious network traffic"
delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.

[Sioux C. Queue]

On 05/05/2013 10:03 AM, Peter N. M. Hansteen wrote:

> Your references to OpenSUSE and IP Filter had me a bit confused.

And obviously me too. In my defense, in addition to the OpenBSD 5.3 install, I
haven't done much with BSD since the 90's so my memory is fuzzy, I just finished
(well mostly finished) upgrading two computers to OpenSUSE 12.3 and there's overlap.

> In PF configuration, the keyword 'self' expands to all addresses
> assigned to all interfaces on the host (as a man pf.conf and search for
> self would have told you).

Thanks, I'll look at that also. Again in my defense, I've always looked at the
INSTALL file, README file, any FAQ's I can find, and lastly whatever
documentation I can find. I've always considered man pages as something you
refer back to after you've figured out how a command works, but need a refresher
on a specific option.

[Peter N. M. Hansteen]

The <***@have.it> address bounces (domain exists, user does not), which
brings back the less fond memories of the 1990s when such asshattery was
to some extent tolerated and even condoned in some circles due to the
then-emerging (oh, so intolerable) spam problem.

But even without the bouncing address, the messate is a textbook example
of how *not* to ask questions.

> The FAQ at OpenSUSE is a fine document.

That's possible, but OpenSUSE is a Linux distribution, irrelevant here,
so the reader is likely to stop reading after the first sentence

But then you do manage to dig up some relevancy, unfortunately too
jubled to actually make much sense:

> On the page www.openbsd.org/faq/pf/tables.html I found this "or the
> self keyword". On the page www.openbsd.org/faq/pf/filter.html I found
> this "table <firewall> const { self }". And finally, I think, at
> www.openbsd.org/faq/pf/nat.html there's this "The word self will
> appear if the state is floating". All of which are nice. What
> exactly is "self"? The computer has two NICs, which one is "self"?
> Is it context dependent? Along that same line, where can I find a
> list, with a definition, of "keywords" for IP Filter? They're
> mentioned a lot.

For good measure, here you end up with asking for documentation on "IP
Filter", which is one of the several names for Darren Reed's ipf (which
lives on in among others Oracle's Solaris, NetBSD, and FreeBSD), the
subsystem that PF was specifically created to replace in OpenBSD, mainly
for licensing reasons.

But that's enough for now, and I suppose some level of ignorance is
excusable. Read on for the helpful part.

> Any and all help would be appreciated.

First, in contast to at least some Unix-like systems, you can expect
OpenBSD's man pages to be up to date, correct and relevant. The list of
keywords for *PF* (not "IP Filter"), is most easily accessible by typing
man pf.conf on a PF-equipped system or if you're still in a web-only
exploring phase, go to http://www.openbsd.org, click the "Manuals" link,
and then type pf.conf into the search field and click the "Submit" button.

That will land you on http://www.openbsd.org/cgi-bin/man.cgi?query=pf.conf&apropos=0&sektion=0&manpath=OpenBSD+Current&arch=i386&format=html

All OpenBSD man pages are accessible in this way.

If you find the man pages too terse or you want more examples, the PF
FAQ which you've already found is a useful resource. It's also likely
you can find useful material via the mailing list archives (both for
this one and openbsd-misc, or for that matter openbsd-newbies).

And finally, for PF examples there is one more oft-cited resource, my
own The Book of PF (http://nostarch.com/pf2.htm) or the PF tutorial that
it grew out of (http://home.nuug.no/~peter/pf/, which links to full text
versions plus recent slides from conferences that cover more than the
BSD-licensed tutorial text).

- Peter

--
Peter N. M. Hansteen, member of the first RFC 1149 implementation team
http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/
"Remember to set the evil bit on all malicious network traffic"
delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.

[Stuart Henderson]

On 2013/05/05 13:29, Peter N. M. Hansteen wrote:
> But even without the bouncing address, the messate is a textbook example
> of how *not* to ask questions.

I think the textbook in question here is "introduction to trolling, an
entry-level guide" :)

[Mike Erdely]

On Sun, May 5, 2013 at 7:29 AM, Peter N. M. Hansteen <***@bsdly.net> wrote:
> The <***@have.it> address bounces (domain exists, user does not), which
> brings back the less fond memories of the 1990s when such asshattery was
> to some extent tolerated and even condoned in some circles due to the
> then-emerging (oh, so intolerable) spam problem.

That is annoying.

> But even without the bouncing address, the messate is a textbook example
> of how *not* to ask questions.
>
>> The FAQ at OpenSUSE is a fine document.

I'm leaning towards giving the benefit of the doubt that muscle memory
or autocorrect switched OpenBSD -> OpenSUSE.

Though, it's frustrating when a simple RFTM is the answer to a
question when the fucking manual is more easily available than the
other links cited by OP.

-ME

[Karl O. Pinc]

On 05/05/2013 06:29:01 AM, Peter N. M. Hansteen wrote:

> First, in contast to at least some Unix-like systems, you can expect
> OpenBSD's man pages to be up to date, correct and relevant.

And, IMO, the OpenBSD man pages are some of the best
technical references anywhere, ever. They are on-par
with the IBM 368-370 Assembly Language Reference Manual
from the 1970's.

Sadly well written reference material requires the
ability to read. Information is not repeated and
anything missed or mis-understood when first read
will cause endless confusion. Anyone not familiar
with the material must read with care, and re-read.
Those who do so will be rewarded with full understanding.

Alternately, a plethora of advice is available from
random strangers on the Internet....

Regards,

Karl <***@meme.com>
Free Software: "You don't pay back, you pay forward."
-- Robert A. Heinlein

[Rod Whitworth]

On Sat, 04 May 2013 13:08:39 -0800, Sioux C. Queue wrote:

>The FAQ at OpenSUSE is a fine document. On the page
>www.openbsd.org/faq/pf/tables.html I found this "or the self keyword". On the
>page www.openbsd.org/faq/pf/filter.html I found this "table <firewall> const {
>self }". And finally, I think, at www.openbsd.org/faq/pf/nat.html there's this
>"The word self will appear if the state is floating". All of which are nice.
>What exactly is "self"? The computer has two NICs, which one is "self"? Is it
>context dependent? Along that same line, where can I find a list, with a
>definition, of "keywords" for IP Filter? They're mentioned a lot.
>
>Any and all help would be appreciated.

<quote>The FAQ at OpenSUSE is a fine document.</quote> - huh?

As usual the man page is the place to go. In pf.conf's man page there
is even a definition of "self" as it is used in pf.conf.

Unusually (for man pages) man 5 pf.conf has a BNF statement of the
syntax. You should learn about BNF if you don't know it.

R/


*** NOTE *** Please DO NOT CC me. I <am> subscribed to the list.
Mail to the sender address that does not originate at the list server is tarpitted. The reply-to: address is provided for those who feel compelled to reply off list. Thankyou.

Rod/
---
This life is not the real thing.
It is not even in Beta.
If it was, then OpenBSD would already have a man page for it.

[Mike Erdely]

On Sat, May 4, 2013 at 5:08 PM, Sioux C. Queue <***@have.it> wrote:
> The FAQ at OpenSUSE is a fine document. On the page
> www.openbsd.org/faq/pf/tables.html I found this "or the self keyword". On the
> page www.openbsd.org/faq/pf/filter.html I found this "table <firewall> const {
> self }". And finally, I think, at www.openbsd.org/faq/pf/nat.html there's this
> "The word self will appear if the state is floating". All of which are nice.
> What exactly is "self"? The computer has two NICs, which one is "self"? Is it
> context dependent? Along that same line, where can I find a list, with a
> definition, of "keywords" for IP Filter? They're mentioned a lot.
>
> Any and all help would be appreciated.

>From the manual (http://www.openbsd.org/cgi-bin/man.cgi?query=pf.conf):

self Expands to all addresses assigned to all
interfaces.

Hope that helps.
-ME