PF on FreeBSD

PF rule sections:

Macros: user-defined variables
Tables
Control options
Scrub: packet normalization and defragmentation
Queues: bandwidth and priority management (ALTQ)
Transformations: NAT and port forwarding
Filter rules

How filtering rules work

The last rule matching the specified criteria is applied. The quick parameter stops rule evaluation when the current rule matches. If pass all is placed first, packets are allowed when no subsequent rule matches.

rc.conf

pf_enable="NO"
pf_rules="/etc/pf/pf.conf"
pf_program="/sbin/pfctl"
pf_flags=""
pflog_enable="YES"
pflog_logfile="/var/log/pf.log"
pflog_program="/sbin/pflogd"
pflog_flags=""
pfsync_enable="NO"
pfsync_syncdev=""
pfsync_ifconfig=""

Rules

General form: action [direction] [log] [quick] [on interface] [af] [proto protocol] [from src_addr [port src_port]] [to dst_addr [port dst_port]] [flags tcp_flags] [state]

Configuration

#--------------
# FILE pf.conf
#--------------

#------------
# 1. Marcos
#------------
ext_if="em0"

#------------
# 2. Tables
#------------
# Table of IP addresses blocked from connecting to port 25
table  persist file "/etc/pf/ip_blocksmtp"

#------------
# 3. Options
#------------
set skip on lo0
set block-policy return

#------------
# 4. Scrub
#------------
scrub in all

#------------
# 5. Queue ALTQ
#------------

#------------
# 6. NAT, port map
#------------

#------------
# 7. Filter
#------------
pass all
pass on lo0
block drop in quick log on $ext_if from 

#---------------
# END of pf.conf
#---------------

Command

# Enable
pfctl -e

# Disable
pfctl -d

# Show current rules
pfctl -sr

# Check rules without applying them
pfctl -nf /etc/pf/pf.conf

# Apply rules
pfctl -f /etc/pf/pf.conf

# Show table contents
pfctl -t tablebname -T show

# Add an address to a table
pfctl -t tablebname -T add 192.168.1.1 

# Remove an address from a table
pfctl -t tablename -T delete 192.168.1.1