This is not really possible with pf on its own. To do something like
this you really need to be running either a protocol specific proxy like
squid or a general IDS like snort that can differentiate based on
traffic payload. In the case of application proxies the blocking will
generally be handled for you since the proxy just won't deal with
traffic it doesn't understand. Snort requires some additional fiddling
to get it to actually stop the traffic in question (by default it will
just log and warn).
-David
Karl Borg wrote:
Hi,
I am trying to do something, but I don't know if it is at all possible
with pf. I have read the doc, and I have found nothing saying that it
is indeed possible, but I may have missed or misunderstood something.
What I am trying to do is, for example, only allowing http connection
to pass through port 80, and/or to block ssh connection through the
same port.
Is it possible to do that with pf ?
How would I do that with pf ?
As it doesn't seem to be possible with pf alone, should I be using
something else instead of pf, or is there something that I could use
with pf to achieve this result ?
Any pointer welcome.
K
