The more I fiddle with OpenBSD Packet Filter (PF), the more I like the way it works when compared to its peers like iptables, ipchains, ipfw and ipf.
Today, I wanted to add logging for all the block rules that I had to track down something. Add a “block in log all label “block-all”” rule and turn on the pflogd service. This dumps all the block log data via pflog0 device and also writes the same to /var/log/pflog in the tcpdump binary logging format.
You can then invoke tcpdump (with all its powerful expression matching features) on -i pflog0 to dump data in real time or use tcpdump -r on the log file for the entire session saved so far.
Also, the concept of assigning labels makes it much easier to understand which rule is being hit for a packet. Assign all rules a “label” and then do pftop -v label.
There is also a SNMP module for pf(4) already in the base system. See /etc/snmpd.config and /usr/share/snmp/mibs/BEGEMOT-PF-MIB.txt.
begemotSnmpdModulePath.”pf” = “/usr/lib/snmp_pf.so”