Building The Network You Need With PF, part 1 -  Peter Hansteen
Channel: EuroBSDcon
Date: 2019-10-13

Who should take this course

This session is aimed at experienced or aspiring network administrators who want to expand their knowledge of PF, the OpenBSD packet filter, and related tools. A basic knowledge of Unix and TCP/IP network configuration is expected and required.

Topics potentially covered include:

- Configuration on OpenBSD, FreeBSD and NetBSD
- PF ruleset basics and rule interactions: block, pass, match
- Writing maintainable rulesets
- Address families: IPv4 NAT vs IPv6
- Redirection, divert and services with odd dependencies (ftp-proxy, spamd)
- Adaptive rulesets (state tracking tricks)
- Traffic shaping with priorities and ‘newqueue’, OpenBSD 5.5 style
- Legacy ALTQ traffic shaping
- Per user filtering with authpf
- High availability with CARP, relayd
- Wireless vs wired networks
- Filtering bridges
- Logging and monitoring – pflog, pflow and others
- Testing, debugging, and optimizing your configuration

Session information

The session will provide updates on the new PF syntax and features introduced in OpenBSD 4.7 (with samples presented in the old and new syntax where appropriate), with newer updates and previews of relevant new features such as the new traffic shaping subsystem introduced in OpenBSD 5.6 and any other PF related improvements in the upcoming OpenBSD 5.6 release (planned release date November 1st, 2014).

Session materials

The available material (notes and slides I’ve accumulated over the years) covers significantly more than the schedule allows for. To help make the session more targeted to your needs, I would appreciate if you, when you sign up for the session or soon after, send me an email to tutorial@bsdly.net with description of what you would like to learn in this session, and to the extent you are allowed and feel it is appropriate, what your near or longer term future project is.Slides matching the latest version of the tutorial can be found at http://home.nuug.no/~peter/pf/newest/; updated slides will be made available to the general public after the present session has concluded.Timing and logistics allowing, copies of the third edition of Hansteen’s The Book of PF will be available to purchase at the session. (Also see The Book of PF, 2nd edition, No Starch Press November 2010).

Speaker biography:

Peter N. M. Hansteen is a consultant, writer and sysadmin based in Bergen, Norway. He has been tinkering with computers since the mid 1980s, mainly while working to document how the systems work and why they don’t, in English as well as his native Norwegian. Peter rediscovered Unixes about the time 386BSD appeared. After a few years on Linux, which included participation in the RFC1149 implementation (2001), he eventually migrated all important systems in his care to FreeBSD and OpenBSD.A long time freenix advocate, he is a member of the BLUG (Bergen (BSD and) Linux User Group) core group and a former vice president of NUUG (the Norwegian Unix User Group). During recent years a frequent lecturer and tutor with emphasis on OpenBSD and FreeBSD topics, author of several articles and The Book of PF (3rd edition No Starch Press 2011) and maintains his blogosphere presence at http://bsdly.blogspot.com.