How do I load and test a pf configuration?

First check the syntax without deploying: pfctl -nf /etc/pf.conf. If there are no errors, load the rules: pfctl -f /etc/pf.conf. You can inspect the firewall state with pfctl -sr (rules) and pfctl -si (statistics). Always test over a connection that will not cut off your access to the server.

How do I avoid locking myself out of SSH when deploying pf?

Before loading the rules, make sure there is a pass rule for the SSH port from your address, and ideally deploy changes through a KVM console or from a separate, already-open session. A temporary cron job that restores the previous configuration after a few minutes, in case the new one cuts off access, is also helpful.

pf.conf Generator (OpenBSD, FreeBSD)

Home / Tools

What pf is and how pf.conf works

pf (Packet Filter) is a network firewall that originated in OpenBSD and is also available in FreeBSD and its derivatives. It is configured declaratively in the pf.conf file, whose strength is a readable, concise syntax and very good performance under heavy traffic. The file is read top to bottom, and a packet's fate is decided by the last matching rule, unless an earlier rule used the quick keyword. A typical, secure layout is: macros, global options (set), normalization (scrub or match scrub), antispoofing rules, a default block all, and finally pass rules allowing specific services. This configurator generates the file in exactly that proven order.

What makes a secure server configuration

Default-deny policy The starting point of every good firewall: block all, followed by explicit pass rules only for the services you need. Anything unforeseen is rejected by default.

Connection state pf tracks state by default (keep state), so it is enough to allow traffic in one direction and the responses pass automatically. This simplifies the rules and improves security.

Antispoofing and bogons The antispoof rule and blocking private and unallocated addresses on the public interface cut off traffic with a spoofed source.

Brute-force protection The max-src-conn and max-src-conn-rate limits with the overload mechanism move overactive addresses to a table and block them. Effective against SSH attacks.

Normalization (scrub) Reassembling fragments and tidying up packets protects against some attacks based on unusual packets and makes filtering more consistent.

OpenBSD vs FreeBSD: key syntax differences

FreeBSD uses an older branch of pf than OpenBSD, which is why some of the notation differs, and the generator adjusts it to the system you choose. The most important difference concerns address translation: in OpenBSD, NAT and forwarding are written with the nat-to and rdr-to keywords inside match or pass rules, while in FreeBSD you still use separate nat on and rdr on rules placed before the filtering rules. The notation for normalization also differs (match ... scrub in OpenBSD vs scrub in FreeBSD). You can always confirm your system's syntax in the man pf.conf manual page.

Frequently asked questions about pf.conf

What is pf and the pf.conf file?+

pf (Packet Filter) is the firewall of BSD systems, from OpenBSD and FreeBSD. It is configured in pf.conf: macros, global options, normalization and pass/block rules. pf is known for its readable syntax and performance.

How does pf differ between OpenBSD and FreeBSD?+

FreeBSD has an older branch of pf. In OpenBSD, translation is written as nat-to and rdr-to inside match/pass; in FreeBSD with separate nat on and rdr on rules. The generator adjusts the syntax to the system.

How do I load and test pf?+

First check the syntax: pfctl -nf /etc/pf.conf. Then load: pfctl -f /etc/pf.conf. Inspect rules with pfctl -sr and statistics with pfctl -si. Test over a connection that will not cut you off.

How do I avoid locking myself out of SSH?+

Make sure there is a pass rule for the SSH port from your address, and deploy from a KVM console or a second session. A temporary cron job that restores the previous configuration, in case the new one cuts off access, helps too.

Does the generator send my configuration to a server?+

No. The pf.conf file is assembled in your browser with JavaScript. The addresses, ports and interfaces you enter are never sent or stored anywhere beyond your device.

Tool and write-up: Marcin Szewczyk-Wilgan, WebOptimo. Syntax based on the pf.conf manual page and hands-on practice configuring firewalls on OpenBSD and FreeBSD servers. Test the generated configuration before deploying. The generator runs in your browser, with no data sent.

Contact

We'll configure your server's firewall

We design and deploy pf rules, harden OpenBSD and FreeBSD servers and look after infrastructure. No obligation — a concrete proposal after a short conversation.

Phone