Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My U-Verse modem has something called "Reflexive ACL" described as

Reflexive ACL: When IPv6 is enabled, you can enable Reflexive Access Control Lists to deny inbound IPv6 traffic unless this traffic results from returning outgoing packets (except as configured through firewall rules).

This seems like a pretty good way to keep from having to maintain a firewall on each computer behind my router that gets handed an IPv6 address. It sounds about like a NAT, which for my small home network is all I want right now.

Now my modem sucks as a router though, so I'm in the process of configuring an OpenBSD router to do that. I've got IPv6 supported and all that and my OpenBSD router will hand out IPv6 addresses by rtadvd. Now I want to keep people from having instant access to my local network through IPv6.

How would I best do something like Reflexive ACL with pf in OpenBSD 5.0?

share|improve this question
up vote 1 down vote accepted

This will do:

pass on $int_if all
pass out on $ext_if all
block in on $ext_if all

This will pass all traffic except on the external interface where it will drop all incoming packets. OpenBSD is stateful by default, so it will allow packets in if it matches an existing connection.

share|improve this answer
Ah ok. Thanks. I'm still learning about how pf works – Earlz Mar 30 '12 at 0:03

That sounds like stateful filtering to me.

The OpenBSD pf.conf man page says the following about keeping state:

By default pf(4) filters packets statefully: the first time a packet matches a pass rule, a state entry is created. The packet filter examines each packet to see if it matches an existing state. If it does, the packet is passed without evaluation of any rules. After the connection is closed or times out, the state entry is automatically removed.

pf will keep state by default.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.