Chapter 17: Basic Packet Filtering

Overview

The name's Pond, James Pond.
Alpha PPK loaded, licensed to filter.

Packet filtering and manipulation are among the most basic tools in network security. OpenBSD includes a very powerful in-kernel packet filter, pf(4), that not only performs standard stateless and stateful packet filtering, but can also inspect and reassemble packet fragments in several ways, redirect connections, translate addresses in several different directions simultaneously, authenticate users, and manage bandwidth.

PF is one of the high points of OpenBSD, and we're going to spend a few chapters discussing it. PF allows you to do some things that commercial firewall vendors still cannot manage reliably.

PF is still undergoing very active development, and new features are added almost weekly. We are only going to discuss those features that are mature and stable. By the time you read this, PF will have features that aren't covered here. Be sure to read the pf.conf(5) man page for details on the nifty features available in your version of OpenBSD.