We can see from the nginx logs that there is an IP address doing nasty things.

How can we block it with a pf command and then later permanently with the /etc/pf.log? How can we block a x.x.x.x/24 for that IP? It is example:

UPDATE: no, looks like OpenBSD doesn't have allow/deny file in /etc. And AFAIK the best advise for blocking abusive IP addresses are using pf.

# cd /etc 
# ls -la|egrep -i 'deny|allow'
# uname -a
OpenBSD foo.com 5.4 GENERIC.MP#0 amd64
  • Do you have a hosts.deny file in the /etc directory?
    – ryekayo
    Commented Aug 22, 2014 at 18:35

3 Answers 3


The best way to do this is to define a table and create a rule to block the hosts, in pf.conf:

table <badhosts> persist
block on fxp0 from <badhosts> to any

And then dynamically add/delete IP addresses from it:

$ pfctl -t badhosts -T add
$ pfctl -t badhosts -T delete

Other 'table' commands include flush (remove all), replace and show. See man pfctl for more.

If you want a more permanent list you can keep it in one (or more) files. In pf.conf:

table <badhosts> persist file "/etc/badguys1" file "/etc/badguys2"
block on fxp0 from <badhosts> to any

You can also add hostnames instead of IP addresses. See the "Tables" section of man pf.conf and man pfctl.

Note: The examples above assume that the internet-facing interface is fxp0, please change according to your setup. Also, keep in mind that the rules in pf.conf are evaluated sequentially and for block or pass rules its the last matching rule that applies. With this ruleset

table <badhosts> persist
block on fxp0 from <badhosts> to any
pass inet tcp from to any port 80

and after adding and to the badhosts table

$ pfctl -t badhosts -T add
$ pfctl -t badhosts -T add

all traffic from and will be blocked but the second host will be able to make connections to other machines' port 80 because the pass rule matches and overrides the block rule.

  • 4
    The block rule can be more easily specified as block in from <badhosts>. You don't need to specify interface or the to any part.
    – kurtm
    Commented Nov 18, 2014 at 15:41

It's not clear from other answers that you need to create an actual table of the badhosts you are trying to block.

This goes in the pf.conf file, for example I have two badguys files, 1&2 badguys1 is for those who come and go, and badguys2 is for permanent blacklisting.

So if you need to add an ip of someone who is a nuisance for a period of time, add them to badguys1.

Now, in your pf.conf file you have this. In my example I use en1, because that's my WiFi interface. Set that to what ever interface your network comes in on.

table <badhosts> persist file "/etc/badguys1" file "/etc/badguys2"
block on en1 from <badhosts> to any

Now you can add temporary addresses to badguys1. (NOT badhosts, that's a name for the tables)

sudo pfctl -t badguys1 -T add

1 table created.
1/1 addresses added.

Although it says 1 table created - it actually adds the ip, not creating a new table. Now if you look in badguys1, you will see the new IP.

sudo pfctl -t badhosts -T show

I got this information from the website and forgive me for my ill knowledge of OpenBSD, but here it goes. Take a look at this URL. According to it, it states to block an IP you would:

echo '' >> /etc/pf.blocked.ip.conf

Then you would restart the firewall:

pfctl -d
pfctl -e -f /etc/pf.conf

Or, to add without restarting the firewall type:

pfctl -t blockedips -T add 111.222.333.444

Now to check if it has been added type:

pfctl -t blockedips -T show

Update: Maybe this would help.

  • Open the following file in vi:

    vi /etc/pf.conf

  • Add the following line of code:

    table <blockedips> persist file "/etc/pf.blocked.ip.conf" ext_if="bge0" # interface connected to internet

  • After that point, I would try restarting the firewall and confirming that the IP is blocked by typing:

    pfctl -d
    pfctl -e -f /etc/pf.conf
    pfctl -t blockedips -T show
  • 1
    I think the table needs to be set to block, but that part is not clear in the howto, I followed it, but the IP is still not blocked Commented Aug 22, 2014 at 19:04
  • Let me see if I can look up how to do so.
    – ryekayo
    Commented Aug 22, 2014 at 19:11
  • 3
    There is no need do disable and reenable pf to reload pf.conf. pfctl -f /etc/pf.conf is enough.
    – Zé Loff
    Commented Sep 10, 2014 at 2:00
  • 1
    (Bad) HOWTOs discourage thinking and encourage copying. Read man pf.conf, you'll be surprised at how good OpenBSD man pages are. Plus, pf.conf files need to be read as a whole (the order in which rules are put is crucial) so copying and pasting single lines is usually a bad idea. Create the file and the table rule (that much is correct) but either you share your whole pf.conf file or it's up to you to figure out the appropriate block rule and its location in the file.
    – Zé Loff
    Commented Sep 10, 2014 at 2:11
  • 1
    @ryekayo Unless you can justify the inclusion of the ext_if="bge0" macro and why you don't have a block rule then I will criticize your answer, because it is incomplete (i.e. not a proper answer), regardless of the effort you put into it. Plus my comment regarding HOWTOs was addressed at the OP, not you (apologies, I should have made that clear).
    – Zé Loff
    Commented Sep 10, 2014 at 9:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .