2

According to OpenBSD's FAQs on "Tables" (http://www.openbsd.org/faq/pf/tables.html), without the persist attribute,

the kernel will automatically remove the table when the last rule referencing it is flushed.

I don't understand what it means and would appreciate a few examples to illustrate it.

1

I'm no expert but I believe it goes something like this:

If your pf rules are static then I don't see a great way to use persist but if they are dynamic (meaning you use anchors in your rules) then rules spring into and out of existence. Persist is what keeps tables alive when the rule set changed and there are no longer any rules that reference them.

I think of anchors as a sort of "import" statement for your pf ruleset and so depending on what you pull in with that anchor, tables you have defined may or may not be referenced.

As one example of how to use anchors on the fly consider:

$ echo "my super cool pf rule that uses table 'foo' that I want inserted" | pfctl -a nameOfAnchor -f -

This will read the new rule straight from stdin and drop "my super cool pf rule that I want inserted" into your rule set as a replacement for the anchor 'nameOfAnchor'. Now maybe the table 'foo' defined previously in your ruleset wouldn't be referenced by anything until you add this rule on the fly with pfctl. If 'foo' used the persist keyword then you are good to go. Otherwise 'foo' would not have existed when you inserted this new rule on the fly and all hell breaks loose. :)

BTW, the 2nd Ed. of Absolute OpenBSD by Michael Lucas has a good section on this near the end. You'll get more details on how to use anchors from there.

And, for an even more focused reference on OpenBSD's PF firewall and its features, you can refer to Peter M. Hansteen's, "The Book of PF," 3rd edition. He also has online material regarding PF.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.