Quick rules¶
Quick Rules are preset policies listed in their own section of the firewall table. Each has a switch; they cannot be edited, but they can be duplicated into an ordinary rule you can change.
| Rule | Default | What it does |
|---|---|---|
| Allow Ping (ICMP) | Off | Answers inbound ping on the internet uplink |
| Allow SSH | Off | Inbound TCP 22 on the internet uplink, from private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) only |
| Block RFC1918 Inbound | Off | Refuses private source addresses arriving on the internet uplink (spoofed internal addresses) |
| Allow DNS Out | On | Outbound DNS, UDP 53 |
| Allow NTP Out | On | Outbound NTP, UDP 123 |
| Block Telnet | Off | Refuses Telnet, TCP 23 |
Quick rules are quick in pf: when one matches, it decides the packet and nothing after it is considered.
Switching one is a configuration change like any other: it takes effect on Apply Changes and is covered by the confirm window.
Block RFC1918 Inbound behind another router
If the device's uplink is itself a private address (it sits behind another router), all its internet traffic arrives from a private address. The device always lets its own DHCP lease and, when an IPsec tunnel is configured, IKE and ESP through, so it cannot strand itself, but other inbound traffic on the uplink is refused.
System rules¶
The System section is maintained by the platform and cannot be switched off:
- Default deny policy
- Drop broadcast and multicast without logging
- Allow loopback
- IPv6 NDP and router discovery
- Stateful outbound tracking
- Management SSH from RFC1918
- Management access to Nexus
These keep the device reachable by the platform whatever rules you add.