A new stateful packet filter for OpenBSD

NetBSD imports pf (port homepage, with mailing list). Almost precisely three years after its birth (on June 24th, 2001), pf is now part of OpenBSD, FreeBSD and NetBSD.

April 30, 2004

We're back from the pf hackathon pf2k4, which was a great experience and very productive. Not all work has been commited yet, but should show up soon.

April 7, 2004

Jeremy Andrews from kerneltrap.org published an Interview with Ryan McBride, an excellent read for anyone interested in CARP and pfsync.

March 30, 2004

Read Ryan McBride's article about Firewall Failover with pfsync and CARP (local copy), these are the most important new features in the upcoming 3.5 release.

CARP (Common Address Redundancy Protocol) is a free alternative to the patent-encumbered VRRP, responsible for electing masters in a firewall cluster, while pfsync syncronizes packet filter state information among nodes.

The combination allows to replace single-point-of-failure firewalls with clusters of two (or more) nodes, which continue to filter ongoing and new connections when nodes fail. Additional features like arpbalance allow to share a single IP address for multiple servers, transparently balancing load among them, and adapting to servers failing.

March 25, 2004

OpenBSD 3.5 is now available for preorder, and will ship May 1st. It introduces CARP, a free router/firewall redundancy and failover protocol.

September 9, 2003

The slides from SUCON '03 are here.

September 4, 2003

Pre-order is now available for OpenBSD 3.4 (see what's new), shipping will start around November 1st.

August 21, 2003

Mike Frantzen added passive OS fingerprinting code to pf, check out his description and the thread on deadly.

July 21, 2003

OpenSoekris provides scripts to install OpenBSD with pf on soekris devices. Also see Soekris on OpenBSD Running Diskless.

July 3, 2003

Jacek Artymiak, known for his series of excellent online articles about pf, has written an entire book on the topic: Building Firewalls with OpenBSD and PF. You can order online.

Michael W . Lucas has written Absolute OpenBSD: UNIX for the Practical Paranoid, which (among other things) covers pf. Shipping has started.

May 22, 2003

We're back from c2k3 (the Hackathon 2003 in Calgary, Canada), pictures available here. Still somewhat jetlagged, so image comments will show up later.

pf work done during the hackathon includes: packet tagging (add arbitrary tags to packets from filter rules and filter based on tags), SYN proxy (protects against spoofed SYN floods by doing a TCP handshake with the client first, then replaying it to the server), adaptive state timeouts (decrease timeouts when the state table grows full), TCP scrubbing, pflog format extentions, and more.

May 2, 2003

The new official PF FAQ has been updated to cover 3.3 and improved greatly by Joel Knight and Nick Holland.

May 1, 2003

OpenBSD 3.3 is officially released, see the announcement which includes a list of the most important pf changes since the previous release.

April 9, 2003

Jeremy Andrews from kerneltrap.org published an article (local copy) about the recent pf port to FreeBSD and the new pf features in OpenBSD 3.3.

April 4, 2003

Pyun YongHyeon has ported pf to FreeBSD, and Max Laier is working on the port and maintains this page with installation instructions and a mailing list.

Earlier this year, Joel Wilsson made a NetBSD port, here's his announcement and web page.

If you're insterested in running pf on those systems, you can help by testing and providing feedback.

April 1, 2003

I found a new job at Junisphere Systems in Switzerland. I'd like to thank everyone who contacted me and offered help, appreciated very much. (this is real, the April's fools joke is here :).

March 27, 2003

OpenBSD 3.3 can be ordered now and will start shipping shortly. If you appreciate our work, please contribute to the project and buy a CD or t-shirt (there's a new shirt, too!). The release will be available for free download as soon as the shipping process has started, and the CVS tree has been tagged with OPENBSD_3_3 already. The official release announcement will appear soon.

March 2, 2003

If you're using an ADSL link or are curious about the recent merge of ALTQ and pf, you might find this article about Prioritizing empty TCP ACKs with pf and ALTQ interesting. It's my favorite feature in the next release, as it makes my downloads much faster :)

March 1, 2003

The slides from the LinuxForum 2003 talk about pf are here (mgp source). A webcast is available, too. And Michael Knudsen made some pictures.

December 11, 2002

On a personal note: the company I work for filed for chapter 11, which means I'll be unemployed by the end of January 2003. If you are hiring Unix programmers (or know someone who does), please contact me for a CV. I'd move to North America, if you can arrange a working permit.

November 26, 2002

ALTQ has been merged with pf, which means pf can now assign packets to queues configured in pf.conf. The announcement contains further details and examples.

November 25, 2002

Initial support for load balancing is introduced in pf.

November 1, 2002

OpenBSD 3.2 is officially released, see the announcement which includes a list of the most important pf changes since release 3.1.

October 31, 2002

Jeremy Andrews from kerneltrap.org has published an interview (local copy) with yours truly about pf.

October 23, 2002

OpenBSD 3.2 will ship starting November 1st. See what's new and order a CD-ROM.

October 7, 2002

ShopIP, DigitalSentinel and NDP Managed Security commercially sell firewall appliances based on OpenBSD 3.1 with pf. If you're looking for a smaller system, Soekris Engineering has embedded boards that run OpenBSD with pf from CompactFlash card. Another option is OpenBrick.

July 26, 2002

There's a mailing list for pf related questions and discussion, to subscribe: echo "subscribe" | mail pf-request@benzedrine.ch. archive (external: MARC, google, mail-archive).

June 20, 2002

The footage (stills and movies) from c2k2 and Usenix are now online. Watch Niklas Hallqvist perform beer hurling in full color motion ;). Thanks to Wim Vandeputte for hosting the files.

June 15, 2002

Usenix 2002 just ended, here's a copy of the presentation Design and Performance of the OpenBSD Stateful Packet Filter , (PDF), originally published in "Proceedings of the FREENIX Track: 2002 USENIX Annual Technical Conference (FREENIX '02)". The slides are available, too. I'll add more comments and pictures from c2k2 and Usenix as soon as I get back home.

May 29, 2002

The reported problems with pf, scrub and bridge(4) have been solved (patch for 3.1-stable).

Updated pf.conf and nat.conf examples, shows filtering an IPv6 tunnel on the gif(4) interface.

May 19, 2002

OpenBSD 3.1 is officially released, see the announcement which includes a list of the most important pf changes since release 3.0.

April 16, 2002

OpenBSD 3.1 will be released shortly! Check out what's new and order a CD-ROM.

April 5, 2002

If you're wondering whether pf is up to the job you need to get done, or uncertain about the maturity that a less than a year old product can offer, read this story (local copy) from someone who knows what he is doing.

April 4, 2002

Bob Beck wrote authpf, an authenticating gateway shell, which dynamically adds and removes filter rules when users login (through ssh). See the article on deadly.org and the authpf(8) man page.

April 1, 2002

The Minister of Propaganda was pulling your leg.

December 10, 2001

Just in case you didn't notice yet, OpenBSD 3.0 has been released! Please support the project and order your CD from OpenBSD.org today.

The FAQ has been updated and now includes useful pf related information, please visit 6.2 Packet Filter (PF) and submit corrections and improvements.

October 4, 2001

If you want to build an ethernet bridge with stateful filtering, here are some hints and catches. You can find a general description of the concept in the Invisible Firewalling How-To.

October 1, 2001

Here's a quick summary of files and man pages related to pf:

/etc/rc.conf pf is disabled by default, use pf=YES to enable it
/etc/pf.conf default filter rules
/etc/nat.conf default NAT rules
pfctl(8) userland tool to configure the packet filter
pflogd(8) logging daemon
pflog(4) logging interface
pf.conf(5) filter rule syntax
nat.conf(5) NAT rule syntax
pf(4) description of the ioctl interface to the kernel
ftp-proxy(8) proxies active FTP connections for NATed clients
authpf(8) authenticating gateway user shell

You might want to enable debug logging with pfctl -x m while testing. If you have questions or bug reports, please write to dhartmei@openbsd.org. 3.0-release is approaching fast, and any bug fixed before the release saves a lot of work :)

The source consists of these files:

sys/net/pfvar.h common definitions for kernel and userland
sys/net/pf.c main kernel source
sys/net/pf_ioctl.c kernel-userland interface
sys/net/pf_norm.c normalizing code (scrub)
sbin/pfctl/pfctl.c pfctl main program
sbin/pfctl/parse.y parser source (yacc)
sbin/pfctl/pfctl_parser.h common definitions for pfctl
sbin/pfctl/pfctl_parser.c common code for pfctl
libexec/ftp-proxy/
usr.sbin/authpf/

September 22, 2001

Check out (and contribute to) Wouter Coene's HOWTO.

June 28, 2001

The last couple of days have been incredibly exciting (and busy ;) for me, and I'd like to post a short update here, since many people have hit this page.

pf is now developed in the OpenBSD CVS tree (-current), and you should get the source from there. You'll notice that changes happen very frequently at the moment.

What has started as an experiment of a single insomniac is now a serious project pursued by a team of very experienced and competent hackers. As you can imagine, I'm very happy with this. It's "OpenBSD's pf" or "pf written by the OpenBSD team" now, and not "Daniel Hartmeier's pf". I might (boldly ;) take credit for the inital spark, but the real work is now being done by a team. Give credit to everyone who is contributing.

I'll leave the old page here intact until everything is covered by man pages, but be warned, nearly everything is now outdated.

License

pf is OSI Certified Open Source Software. It's published under a two-clause BSD license.

Packet Filter

Articles

History

July 7, 2015

July 20, 2011

August 29, 2006

September 20, 2004

June 22, 2004