pfctl

-A

Load only the queue rules present in the rule file. Other rules and options are ignored.

-a anchor

Apply the -f, -F, and -s options only to the rules in the specified anchor. In addition to the main rule set, pfctl can load and manipulate additional rule sets by name, called anchors. The main rule set is the default anchor.

Anchors are referenced by name and may be nested, with the various components of the anchor path separated by slashes (/), similar to how file system hierarchies are laid out. The last component of the anchor path is where rule-set operations are performed.

Evaluation of anchor rules from the main rule set is described in the documentation for pf.conf.

Private tables can also be put inside anchors, either by having table statements in the pf.conf file that is loaded in the anchor, or by using regular table commands, as in:

# pfctl -a foo/bar -t mytable -T add 1.2.3.4 5.6.7.8

When a rule referring to a table is loaded in an anchor, the rule will use the private table if one is defined, and then fall back to the table defined in the main rule set, if there is one. This is similar to C rules for variable scope. It is possible to create distinct tables with the same name in the global rule set and in an anchor, but this is often bad design, and a warning is issued in that case.

-D macro=value

Define macro to be set to value on the command line. This overrides the definition of macro in the rule set.

-d

Disable the packet filter.

-e

Enable the packet filter.

-F modifier

Flush the filter parameters specified by modifier (which you can abbreviate):

nat — flush the NAT rules.
queue — flush the queue rules.
rules — flush the filter rules.
state — flush the state table (NAT and filter).
Sources — flush the source tracking table.
info — flush the filter information (statistics that aren't bound to rules).
Tables — flush the tables.
osfp — flush the passive operating system fingerprints.
all — flush all of the above.

-f file

Load the rules contained in the specified file. This file may contain macros, tables, options, and normalization, queueing, translation, and filtering rules. With the exception of macros and tables, the statements must appear in that order.

Specify - for the file to use standard input.

-g

Include output helpful for debugging.

-h

Display some help information.

-i interface

Restrict the operation to the given interface.

-k host

Kill all of the state entries originating from the specified host. You can specify a second -k option, which will kill all the state entries from the first host to the second host. For example, to kill all of the state entries originating from host:

# pfctl -k host

To kill all of the state entries from host1 to host2:

# pfctl -k host1 -k host2

-m

Merge in explicitly given options without resetting those that are omitted. This option lets you modify single options without disturbing the others:

# echo "set loginterface fxp0" | pfctl -mf -

-N

Load only the NAT rules present in the rule file. Other rules and options are ignored.

-n

Don't actually load rules; just parse them.

-O

(“Oh”) Load only the options present in the rule file. Other rules and options are ignored.

-o

Enable the rule-set optimizer, which attempts to improve rule sets by removing rule duplication and making better use of rule ordering. Specifically, it does the following:

removes duplicate rules
removes rules that are a subset of another rule
combines multiple rules into a table when advantageous
reorders the rules to improve evaluation performance

You can specify a second -o option to use the currently loaded rule set as a feedback profile to tailor the optimization of the quick rules to the actual network behavior.

The rule-set optimizer modifies the rule set to improve performance. A side effect of the ruleset modification is that per-rule accounting statistics will have different meanings than before. If per-rule accounting is important (e.g. for billing purposes), either you shouldn't use the rule-set optimizer, or you should add a label field to all of the accounting rules to act as optimization barriers.

-p device

Use the device file device instead of the default, /dev/pf.

-q

Print only errors and warnings.

-R

Load only the filter rules present in the rule file. Other rules and options are ignored.

-r

Perform reverse DNS lookups on states when displaying them.

-s modifier

Show the filter parameters specified by modifier (which you can abbreviate):

nat — show the currently loaded NAT rules.
queue — show the currently loaded queue rules. When used together with -v, pfctl also shows per-queue statistics. When used together with -v -v, pfctl loops and shows updated queue statistics every five seconds, including measured bandwidth and packets per second.
rules — show the currently loaded filter rules. When used together with -v, pfctl also shows the per-rule statistics (number of evaluations, packets and bytes).
Note that the skip step optimization done automatically by io-pkt skips the evaluation of rules where possible. Packets passed statefully are counted in the rule that created the state (even though the rule isn't evaluated more than once for the entire connection).
Anchors — show the currently loaded anchors directly attached to the main ruleset. If you also specify -a anchor, the anchors loaded directly below the given anchor are shown instead. If you specify -v, all anchors attached under the target anchor are displayed recursively.
state — show the contents of the state table.
Sources — show the contents of the source-tracking table.
info — show filter information (statistics and counters). When used together with -v, source tracking statistics are also shown.
labels — show per-rule statistics (label, evaluations, packets, bytes) of filter rules with labels. This can be useful for accounting.
timeouts — show the current global timeouts.
memory — show the current pool memory hard limits.
Tables — show the list of tables.
osfp — show the list of operating system fingerprints.
Interfaces — show the list of interfaces and interface drivers available to PF. When used together with a double -v option, pfctl also shows interface statistics. You can use the -i option to select an interface or a group of interfaces.
all — show all of the above, except for the lists of interfaces and operating system fingerprints.

-T command [address ...]

Specify the command (which you can abbreviate) to apply to the table. The commands include:

kill — kill a table.
flush — flush all addresses of a table.
add — add one or more addresses in a table. Automatically create a nonexisting table.
delete — delete one or more addresses from a table.
replace — replace the addresses of the table. Automatically create a nonexisting table.
show — show the content (addresses) of a table.
test — test if the given addresses match a table.
zero — clear all the statistics of a table.
load — load only the table definitions from pf.conf. You use this in conjunction with the -f option, as in:
```
# pfctl -Tl -f pf.conf
    
```

For the add, delete, replace, and test commands, you can specify the list of addresses either directly on the command line and/or in an unformatted text file, using the -f flag. Comments starting with a # are allowed in the text file. With these commands, you can also use the -v option once or twice, in which case pfctl prints the detailed result of the operation for each individual address, prefixed by one of the following letters:

A — the address/network has been added.
C — the address/network has been changed (negated).
D — the address/network has been deleted.
M — the address matches (test operation only).
X — the address/network is duplicated and therefore ignored.
Y — the address/network can't be added/deleted due to conflicting ! attributes.
Z — the address/network has been cleared (statistics).

Each table maintains a set of counters that you can retrieve using the -v option. For example, the following commands define a wide-open firewall that keeps track of packets going to or coming from the OpenBSD FTP server. The following commands configure the firewall and send 10 pings to the FTP server:

# printf "table <test> { ftp.NetBSD.org }\n \
      pass out to <test> keep state\n" | pfctl -f-
# ping -qc10 ftp.NetBSD.org

We can now use the table show command to output, for each address and packet direction, the number of packets and bytes that are being passed or blocked by rules referencing the table. The time at which the current accounting started is also shown with the Cleared line:

# pfctl -t test -vTshow
     129.128.5.191
        Cleared:     Thu Feb 13 18:55:18 2003
        In/Block:    [ Packets: 0        Bytes: 0        ]
        In/Pass:     [ Packets: 10       Bytes: 840      ]
        Out/Block:   [ Packets: 0        Bytes: 0        ]
        Out/Pass:    [ Packets: 10       Bytes: 840      ]

Similarly, you can view global information about the tables by using the -v option twice with the -s Tables command. This displays the number of addresses on each table, the number of rules that reference the table, and the global packet statistics for the whole table:

# pfctl -vvsTables
--a-r-  test
    Addresses:   1
    Cleared:     Thu Feb 13 18:55:18 2003
    References:  [ Anchors: 0        Rules: 1        ]
    Evaluations: [ NoMatch: 3496     Match: 1        ]
    In/Block:    [ Packets: 0        Bytes: 0        ]
    In/Pass:     [ Packets: 10       Bytes: 840      ]
    In/XPass:    [ Packets: 0        Bytes: 0        ]
    Out/Block:   [ Packets: 0        Bytes: 0        ]
    Out/Pass:    [ Packets: 10       Bytes: 840      ]
    Out/XPass:   [ Packets: 0        Bytes: 0        ]

In this case, only one packet — the initial ping request — matched the table, but all packets passing as the result of the state are correctly accounted for. Reloading the table(s) or ruleset doesn't affect packet accounting in any way. The two XPass counters are incremented instead of the Pass counters when a “stateful” packet is passed but doesn't match the table anymore. This will happen in our example if someone were to flush the table while the ping command was running.

When used with a single -v, pfctl displays only the first line containing the table flags and name. The flags are defined as follows:

c — constant tables, which can't be altered outside pf.conf.
p — persistent tables, which don't get automatically killed when no rules refer to them.
a — tables that are part of the active table set. Tables without this flag don't really exist, can't contain addresses, and are listed only if you specify the -g option.
i — tables that are part of the inactive table set. This flag can be witnessed only briefly during the loading of pf.conf.
r — tables that are referenced (used) by rules.
h — a table in the main rule set is hidden by one or more tables of the same name from anchors attached below it.

-t table

Specify the name of the table.

-v

Produce more verbose output. If you specify a second -v, pfctl produces even more verbose output including rule set warnings. See above for its effect on table commands.

-x level

Set the debugging level to one of the following (which you can abbreviate):

none — don't generate debug messages.
urgent — generate debug messages only for serious errors.
misc — generate debug messages for various errors.
loud — generate debug messages for common conditions.

-z

Clear per-rule statistics.

Description:

The pfctl utility communicates with the packet filter device using the ioctl() or ioctl_socket() interface described in pf. It lets you configure rule sets and parameters and retrieve status information from the packet filter.

Packet filtering restricts the types of packets that pass through network interfaces entering or leaving the host based on filter rules as described in pf.conf. The packet filter can also replace addresses and ports of packets. Replacing source addresses and ports of outgoing packets is called NAT (Network Address Translation) and is used to connect an internal network (usually reserved address space) to an external one (the Internet) by making all connections to external hosts appear to come from the gateway. Replacing destination addresses and ports of incoming packets is used to redirect connections to different hosts and/or ports. A combination of both translations, bidirectional NAT, is also supported. Translation rules are described in the documentation for pf.conf.

The packet filter doesn't itself forward packets between interfaces. Forwarding can be enabled by setting the sysctl variables net.inet.ip.forwarding and/or net.inet6.ip6.forwarding to 1. Set them permanently in /etc/sysctl.conf.

`pfctl`

Syntax:

Runs on:

Options:

Description:

Files:

See also: