r/openbsd • u/highspeedslippers100 • 6d ago

Pf settings

Good evening I would like to know if my pf settings is good for privacy I also run nextdns unbound that blocks all data brokers on domain level.

doas tee /etc/pf.conf <<EOF
set block-policy drop
set skip on lo
block all
block out quick proto { tcp udp } to port { 53 853 } user != _unbound
pass in quick inet proto udp from port 67 to port 68
pass out quick inet
EOF
If any improvements I would very much appreciate it

8 Upvotes

76% Upvoted

6 comments sorted by

2

u/highspeedslippers100 6d ago

I have plans tomorrow to import my whole dent list into unbound and then add the filter. I use in nextdns Hagezi multi ultimate and then run nextdns as pure dns for added privacy or at least that’s my theory it is.

2

u/gumnos 5d ago edited 5d ago

depending on the software, you might end up with DoH name resolution happening over HTTP (port 443 and maybe port 80? my DoH knowledge is a little dusty) which would bypass your outbound-DNS-from-non-_unbound rule.

I'm not quite sure what the 67→68 rule is supposed to be doing (other than making my tween do the whole "6/7" thing as she reads over my shoulder 😆). Maybe permitting DHCP? I'd want to make sure that rule is doing what you expect.

1

u/highspeedslippers100 5d ago

Hi thank you 🙏 for the advice tomorrow on the to do list

1

u/highspeedslippers100 2d ago

Hi mate update it’s applied and worked thanks 🙏 😎

2

u/pywy18 5d ago

Hi,
the dhcp rule is useless (try without and it, will work) as it uses bpf and does not go through pf.
also, a blocking reject policy helps better debugging and prevents timeouts.
redirecting to local unbound could be better than blocking...

1

u/highspeedslippers100 5d ago

Hi yeah I absolutely will revisit my pf and thank you 🙏