P
Peter Hansteen
home.nuug.no/~peter · Personal blog · on HN since 2010
Peter Hansteen is a Norwegian sysadmin and author who writes tutorials and talks on OpenBSD, the PF packet filter, and networking.
What HN saysHN commenters call his PF tutorial top notch and link his talks, including 'OpenBSD and You' and his guide to blocking brute-force attacks with PF.
16HN people shared it
9linked it in comments
8stories submitted
22story points
4 years agolast shared
2010people per year2026
Most-shared posts
- 1OpenBSD and you3 people · 7 points · first shared 2016 · discussion on HN
- 2Firewalling with OpenBSD's PF packet filter3 people · 6 points · first shared 2010 · 1 comments on HN
- 3Turning away the brutes2 people · 1 points · first shared 2016 · discussion on HN
- 4Recent and not so recent changes in OpenBSD that make life better1 people · 3 points · first shared 2021 · 1 comments on HN
- 5Network Management with the OpenBSD Packet Filter Toolset1 people · 2 points · first shared 2022 · discussion on HN
- 6OpenBSD and you1 people · 2 points · first shared 2016 · discussion on HN
- 7Building the Network You Need with OpenBSD's PF1 people · 1 points · first shared 2014 · discussion on HN
- 8Nat641 people · first shared 2013
- 9Pf favorite1 people · first shared 2022
- 10Img11 people · first shared 2016
- 11En1 people · first shared 2018
- 12Spamd.setup1 people · first shared 2015
What HN people wrote when they linked it
peter_hansteen · 2022-09-25
From the most recent SEMIBUG meeting, slides at https://home.nuug.no/~peter/pf_favorite/, trackerless full text https://nxdomain.no/~peter/better_off_with_pf.html
petee · 2018-06-20
And Peter Hansteen's PF tutorial is top notch too:
https://home.nuug.no/~peter/pf/en/
he also has a book that I've heard is great, but don't own (yet)
marios · 2013-03-29
I find it ironic that the h-online was 'corrected' following a reader's comment ("IPv4 host can not initiate a connection with a IPv6 only host with NAT64"). This is actually false. The NAT64 gateway _can_ do this, provided you have configured it correctly.
I found this http://home.nuug.no/~peter/pf/eurobsdcon2012/nat64.html quite helpful, as well as a post on the mailing list [1] describing commong scenarios. Of course, the pf.conf manpage describes with all the details, but that should go without saying :-)
[1] http://www.mail-archive.com/[email protected]/msg107255.html
icybox · 2022-04-21
Obligatory link to Peter N.M. Hansteen's presentation "OpenBSD and You". On slide 6, you'll see which operating systems use OpenBSD's code to its benefit.
https://home.nuug.no/~peter/openbsd_and_you/
EDIT:grammar
Cieplak · 2018-05-26
Came here to suggest that, too. Here’s a tutorial on doing it with the pf firewall:
https://home.nuug.no/~peter/pf/en/bruteforce.html
nickpsecurity · 2016-11-30
Interesting for this post to turn up as I was drafting and getting review for my own rebuttal to OpenBSD propaganda on Schneier's forum. I couldn't find it as I needed it. (shrugs) Quick attempt at redoing it here.
Started with this on Lobste.rs forum that's popular for OpenBSD developers:
https://home.nuug.no/~peter/blug2016/img1.html
Similar to some of the BS allthatiswrong counters. I'm just focusing on a few as it will already be a long writeup with many examples from history on where secure coding and UNIX really came from. In this Pastebin:
http://pastebin.com/6cW3FyJE
hiphopyo · 2015-02-14
Also check this by the author of "The Book of PF": http://home.nuug.no/~peter/pf/en/spamd.setup.html
- isn't SpamAssassin too big, too old and too ugly considering it, according to the author, only stands for 5% of the anti-spam?
- can ClamAV really catch modern malware or are we just talking legacy viruses from the 90s and 2000s?
tls · 2013-09-14
block in all
pass out all
last rule wins, and obviously if it is remote allow ssh port etc.
You can read more here: http://home.nuug.no/~peter/pf/en/long-firewall.html
samuel · 2010-10-13
When I ran OpenBSD I used to block on repeated failed attempts(see: http://home.nuug.no/~peter/pf/en/long-firewall.html#BRUTEFORCE).
I used to change ssh's port, but not anymore. If a bruteforce attack is a threat to you, then you are better being compromised by a random script kiddie or spammer than by a targeted attacker looking after your data. Take that scans as free, low skilled, penetration tests.