| PFCTL(8) | AerieBSD 1.0 Refernce Manual | PFCTL(8) |
# pfctl -a "authpf/smith(1234)" -s rules
Private tables can also be put inside anchors, either by having table statements in the pf.conf(5) file that is loaded in the anchor, or by using regular table commands, as in:
# pfctl -a foo/bar -t mytable -T add 1.2.3.4 5.6.7.8
When a rule referring to a table is loaded in an anchor, the rule will use the private table if one is defined, and then fall back to the table defined in the main ruleset, if there is one. This is similar to C rules for variable scope. It is possible to create distinct tables with the same name in the global ruleset and in an anchor, but this is often bad design and a warning will be issued in that case. By default, recursive inline printing of anchors applies only to unnamed anchors specified inline in the ruleset. If the anchor name is terminated with a ‘*’ character, the -s flag will recursively print all anchors in a brace delimited block. For example the following will print the “authpf” ruleset recursively:
# pfctl -a 'authpf/*' -sr
To print the main ruleset recursively, specify only ‘*’ as the anchor name:
# pfctl -a '*' -sr
# echo "set loginterface fxp0" | pfctl -mf -
# pfctl -Tl -f pf.conf
# printf "tablecounters { ftp.openbsd.org }\en \e pass out to \en" | pfctl -f- # ping -qc10 ftp.openbsd.org
We can now use the table -show command to output, for each address and packet direction, the number of packets and bytes that are being passed or blocked by rules referencing the table. The time at which the current accounting started is also shown with the “Cleared” line.
# pfctl -t test -vTshow
129.128.5.191
Cleared: Thu Feb 13 18:55:18 2003
In/Block: [ Packets: 0 Bytes: 0 ]
In/Pass: [ Packets: 10 Bytes: 840 ]
Out/Block: [ Packets: 0 Bytes: 0 ]
Out/Pass: [ Packets: 10 Bytes: 840 ]
Similarly, it is possible to view global information about the tables by using the -v modifier twice and the -s -Tables command. This will display the number of addresses on each table, the number of rules which reference the table, and the global packet statistics for the whole table:
# pfctl -vvsTables
--a-r-C test
Addresses: 1
Cleared: Thu Feb 13 18:55:18 2003
References: [ Anchors: 0 Rules: 1 ]
Evaluations: [ NoMatch: 3496 Match: 1 ]
In/Block: [ Packets: 0 Bytes: 0 ]
In/Pass: [ Packets: 10 Bytes: 840 ]
In/XPass: [ Packets: 0 Bytes: 0 ]
Out/Block: [ Packets: 0 Bytes: 0 ]
Out/Pass: [ Packets: 10 Bytes: 840 ]
Out/XPass: [ Packets: 0 Bytes: 0 ]
As we can see here, only one packet \- the initial ping request \- matched the table, but all packets passing as the result of the state are correctly accounted for. Reloading the table(s) or ruleset will not affect packet accounting in any way. The two “XPass” counters are incremented instead of the “Pass” counters when a “stateful” packet is passed but doesn't match the table anymore. This will happen in our example if someone flushes the table while the ping(8) command is running. When used with a single -v, pfctl will only display the first line containing the table flags and name. The flags are defined as follows:
| AerieBSD 1.0 Reference Manual | December 26 2008 | PFCTL(8) |