|This article needs additional citations for verification. (July 2011)|
PF was originally designed as replacement for Darren Reed's IPFilter, from which it derives much of its rule syntax. IPFilter was removed from OpenBSD's CVS tree on 30 May 2001 due to OpenBSD developers' concerns with its license.
It was later extensively redesigned by Henning Brauer and Ryan McBride with most of the code written by Henning Brauer. Henning Brauer is currently the main developer of PF.
The filtering syntax is similar to IPFilter, with some modifications to make it clearer. Network Address Translation (NAT) and Quality of Service (QoS) have been integrated into PF, QoS by importing the ALTQ queuing software and linking it with PF's configuration. Features such as pfsync and CARP for failover and redundancy, authpf for session authentication, and ftp-proxy to ease firewalling the difficult FTP protocol, have also extended PF. Also PF supports SMP (Symmetric multiprocessing) & STO (Stateful Tracking Options).
One of the many innovative feature is PF's logging. PF's logging is configurable per rule within the pf.conf and logs are provided from PF by a pseudo-network interface called pflog, which is the only way to lift data from kernel-level mode for user-level programs. Logs may be monitored using standard utilities such as tcpdump, which in OpenBSD has been extended especially for the purpose, or saved to disk in the tcpdump/pcap binary format using the pflogd daemon.
Apart from running on its home platform OpenBSD, PF has been ported to many other operating systems.
However it must be noted that there are major differences in capabilities. Some ports date back many years. OpenBSD always has the latest version with the most features.
PF is currently used in:
- FreeBSD starting with version 5.3
- Apple Mac OS X Lion (OS X 10.7), Mountain Lion (OS X 10.8), Mavericks (OS X 10.9) Yosemite (OS X 10.10), El Capitan (OS X 10.11).
- Apple iOS the operating system used by all iPhones and iPads
- NetBSD from version 3.0
- DragonFly BSD from version 1.2
- Debian GNU/kFreeBSD
- QNX and thereby in many BlackBerry smartphones models
- PfSense free open source FreeBSD based firewall, router
- OPNsense free open source FreeBSD based firewall, fork of PfSense
- Core force, a firewalling and security product for Microsoft Windows, is derived from PF
Annotated example pf.conf file
## Macros # The internal interface (connected to the local network). int_if="xl0" ## Options # Set the default policy to return RSTs or ICMPs for blocked traffic. set block-policy return # Ignore the loopback interface entirely. set skip on lo0 ## Translation rules # NAT traffic on the interface in the default egress interface group (to # which the interface out of which the default route goes is assigned) from the # local network. match out on egress from $int_if:network to any nat-to (egress) ## Filtering rules # Default deny rule, with all blocked packets logged. block log all # Pass all traffic to and from the local network, using quick so that later # rules are not evaluated if a packet matches this. Some rulesets would restrict # local traffic much further. pass quick on $int_if all # Permit all traffic going out, keep state so that replies are automatically passed; # many rulesets would have many rules here, restricting traffic in and out on the # external (egress) interface. (keep state is not needed in the newest version of pf) pass out keep state
- Hansteen, Peter N.M. (November 2010). The Book of PF: A No-Nonsense Guide to the OpenBSD Firewall (2 ed.). No Starch Press. p. 216. ISBN 978-1-59327-274-6.
- Jeremy C. Reed, ed. (August 2006). The OpenBSD PF Packet Filter Book: PF for NetBSD, FreeBSD, DragonFly, and OpenBSD. Reed Media Services. p. 193. ISBN 978-0-9790342-0-6.
|The Wikibook Guide to Unix has a page on the topic of: OpenBSD PF|
- OpenBSD Kernel Interfaces Manual –
- OpenBSD System Manager's Manual –
- The OpenBSD PF guide
- The OpenBSD 3.6 release song with humorous background information on PF's creation
- PF section on Daniel Hartmeier's site
- PF tutorial by Peter N. M. Hansteen
- Packet Filter Wiki