GSP
Quick Navigator

Search Site

Unix VPS
A - Starter
B - Basic
C - Preferred
D - Commercial
MPS - Dedicated
Previous VPSs
* Sign Up! *

Support
Contact Us
Online Help
Handbooks
Domain Status
Man Pages

FAQ
Virtual Servers
Pricing
Billing
Technical

Network
Facilities
Connectivity
Topology Map

Miscellaneous
Server Agreement
Year 2038
Credits
 

USA Flag

 

 

Man Pages


Manual Reference Pages  -  SRV2PF (1)

.ds Aq ’

NAME

srv2pf - Create and update PF tables from DNS records

CONTENTS

SYNOPSIS

<B>srv2pfB> [<B>-46npvB>] <B>-tB> table name[<B>:B>service[<B>:B>transport]] [...]

DESCRIPTION

The <B>srv2pfB> utility creates and updates PF address tables based on DNS records.

For each name specified on the command line, the <B>srv2pfB> utility performs a DNS lookup for SRV, CNAME, A and AAAA records. The right-hand side of any SRV and CNAME records encountered are resolved recursively.

If no errors occured during this process, a PF address table with the name specified on the command line is either created or updated to match the list of IP addresses that were found. If the table already exists, its contents are replaced with the list that was obtained from DNS, unless the <B>-pB> option was specified, in which case the table is treated as append-only.

The following options are available:
<B>-4B> Include IPv4 addresses in the table. If neither <B>-4B> nor <B>-6B> is specified, the default is to include both IPv4 and IPv6 addresses.
<B>-6B> Include IPv6 addresses in the table. If neither <B>-4B> nor <B>-6B> is specified, the default is to include both IPv4 and IPv6 addresses.
<B>-tB> table The name of the table to be created or update. This option is mandatory.
<B>-nB> Perform all LDAP and DNS lookups, but do not create or update any PF tables.
<B>-pB> Preserve existing table entries even if they are not encountered in DNS lookups.
<B>-vB> Show progress and debugging information.
Each subsequent argument is a service specification consisting of at least one and at most three items, separated by colons. The first is a DNS name. The second is a comma-separated list of service names, which defaults to http,https. The third is a comma-separated list of transport protocols, which defaults to tcp. At least one service specification must be provided.

EXAMPLES

Update a table named ldap used to allow traffic from the organization’s internal network to its LDAP servers:



    % grep -w ldap /etc/pf.conf
    table <ldap> persist
    pass in on int proto tcp from int:network to <ldap> port { ldap, ldaps }
    pass out on dmz proto tcp from int:network to <ldap> port { ldap, ldaps }
    % sudo srv2pf -pv -t ldap example.com:ldap:tcp
    # looking up SRV for _ldap._tcp.example.com
    # looking up dc01.example.com
    # dc01.example.com. 50339   IN      AAAA    2001:db8:0:42::dc1
    # dc01.example.com. 50339   IN      A       198.51.100.221
    # looking up dc02.example.com
    # dc02.example.com. 302     IN      AAAA    2001:db8:0:42::dc02
    # dc02.example.com. 128     IN      A       198.51.100.222
    # looking up example.com
    /sbin/pfctl -t ldap -T add 198.51.100.221 198.51.100.222 2001:db8:0:42::dc01 2001:db8:0:42::dc02
    No ALTQ support in kernel
    ALTQ related functions disabled
    4/4 addresses added.



SEE ALSO

pf(4), pfctl(8)

AUTHOR

The <B>srv2pfB> utility was written by Dag-Erling Smo\k:/rgrav <d.e.smorgrav@usit.uio.no> for the University of Oslo.
Search for    or go to Top of page |  Section 1 |  Main Index


perl v5.20.3 SRV2PF (1) 2015-11-06

Powered by GSP Visit the GSP FreeBSD Man Page Interface.
Output converted with manServer 1.07.