Using OpenBGPD to distribute pf table updates to your servers

OpenBGP+PFOne of the challenges faced when managing our OpenBSD firewalls is the distribution of IPs to pf tables without manually modifying /etc/pf.conf on each of the firewalls every time.

This task becomes quite tedious, specifically when you want to distribute different types of changes to different systems (eg administrative IPs to a firewall and spammer IPs to a mail server), or if you need to distribute real time blacklists to a large number of systems.

The following post outlines one a method of distributing such lists using OpenBGP to deliver them into your pf tables.