I'm looking at options to replace my router with something that offers me more options for content filtering and also content modification.

One of the things that I want to do is to modify HTTP Requests, e.g. Add or Remove certain Headers or the contents of the body (e.g., to remove any references to ga.js). Also, I want to block access to certain sub-paths of a domain, e.g. block twitter.com/widgets without blocking the main twitter.com website (in which case a custom DNS that returns would do the job)

I'm wondering if PF on OpenBSD can do that, or if it's too low level and if I need a higher level tool like a proxy. The problem with using a proxy is that it's not transparent for clients and thus doesn't help e.g. protecting my phone while it's on my WiFi.


To PF or not to PF?

I do not believe pf is the appropriate place to filter a high level element such as ga.js. Rather it operates a layer or two below that. Filtering ga.js would be better suited to something such as a proxy package such as Squid.

excerpt from PF: Packet Filtering

Packet filtering is the selective passing or blocking of data packets as they pass through a network interface. The criteria that pf(4) uses when inspecting packets are based on the Layer 3 (IPv4 and IPv6) and Layer 4 (TCP, UDP, ICMP, and ICMPv6) headers. The most often used criteria are source and destination address, source and destination port, and protocol.

If you're familiar with the OSI model and TCP/IP this diagram shows which layers PF would be working in and which layer your ga.js file would be accessible for filtering.

                                              ss #1

So PF can operate at the Transport & Internet layers. To operate on something such as ga.js you'd need to operate at the Application layer, hence a proxy.

Squid setup

This tutorial should get you started with the setup and configuration of Squid, titled: Web Filtering On Squid Proxy.

  • Thanks. Yeah, I'm basically looking for a Layer 7 Firewall. Thanks for clarifying that PF is Layer 3/4, I'll see if I can find a way to make Squid transparent to clients (this seems promising: cyberciti.biz/tips/… ) or if there are other Layer 7 filtering options. – Michael Stum Mar 21 '14 at 5:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.