View source for PFSENSE - PFCTL Basic Usage

[[Category:wiki]]

== Packet Filter architecture ==
pfctl is the userland control utility for PF (Packet Filter), the stateful firewall subsystem originating from OpenBSD and integrated into pfSense (FreeBSD-based). pfSense dynamically generates PF rules from its configuration and loads them into the kernel via pfctl.

PF operates using:
* Stateful inspection
* Rule evaluation from top to bottom
* First matching rule (with quick exceptions)
* Separate rule sets for filtering, NAT, redirection, and normalization
* Anchors for modular rule management (heavily used by pfSense)

== Rule evaluation flow ==
* Packet enters interface
* Normalization rules (scrub) applied
* NAT / RDR processed
* Filtering rules evaluated
* State table checked/updated
* Packet passed or blocked

== Anchors and pfSense integration ==
pfSense uses anchors extensively to isolate automatically generated rules:
* <nowiki>pfSense</nowiki>
* <nowiki>pfSense/*</nowiki>
* <nowiki>relayd</nowiki>

Anchors allow dynamic insertion and removal of rules without reloading the entire ruleset.

Example:
 <nowiki>
pfctl -a pfSense -sr</nowiki>

== State table management ==
PF is a stateful firewall; every allowed connection is tracked.

Display states:
 <nowiki>
pfctl -s state</nowiki>

Kill a specific state:
 <nowiki>
pfctl -k 192.0.2.10 -k 198.51.100.20</nowiki>

Clear all states:
 <nowiki>
pfctl -Fs</nowiki>

=== Tables and dynamic address management ===
PF tables provide high-performance lookups for large address lists.

List tables:
 <nowiki>
pfctl -s Tables</nowiki>

Show table content:
 <nowiki>
pfctl -t bogons -T show</nowiki>

Add an IP to a table:
 <nowiki>
pfctl -t blocked_hosts -T add 203.0.113.45</nowiki>

Remove an IP:
 <nowiki>
pfctl -t blocked_hosts -T delete 203.0.113.45</nowiki>

=== NAT and redirection inspection ===
Display NAT rules:
 <nowiki>
pfctl -s nat</nowiki>

Display redirection rules:
 <nowiki>
pfctl -s rdr</nowiki>

Show all translation rules:
 <nowiki>
pfctl -s rules | grep nat</nowiki>

=== Rule counters and performance metrics ===
PF tracks packets and bytes per rule.

Show rules with counters:
 <nowiki>
pfctl -vvsr</nowiki>

Reset counters:
 <nowiki>
pfctl -z</nowiki>

This is critical for traffic analysis and policy validation.

=== Normalization and packet scrubbing ===
Scrub rules normalize packets to prevent evasion techniques:
* MSS clamping
* Fragment reassembly
* Invalid flag dropping

Display scrub rules:
 <nowiki>
pfctl -s all | grep scrub</nowiki>

== Security concepts ==

=== Stateful filtering ===
Only packets belonging to a valid state are allowed to pass, reducing attack surface.

=== Default deny policy ===
pfSense enforces an implicit block at the end of rule sets.

Verify block rules:
 <nowiki>
pfctl -sr | grep block</nowiki>

=== Antispoofing ===
PF can prevent IP spoofing on interfaces.

Example:
 <nowiki>
antispoof quick for em0</nowiki>

=== SYN flood protection ===
PF supports SYN proxies and connection rate limiting.

Example rule:
 <nowiki>
pass in proto tcp from any to any flags S/SA keep state (max-src-conn 100, max-src-conn-rate 50/10)</nowiki>

=== Table-based threat mitigation ===
Dynamic tables allow automatic blocking via IDS/IPS or scripts.

Example integration:
* Snort / Suricata populating PF tables
* Fail2ban-style blocking

=== Logging and diagnostics ===
PF logs packets to pflog interfaces.

Enable logging on a rule:
 <nowiki>
pass in log proto tcp from any to any port 22</nowiki>

View logs:
 <nowiki>
tcpdump -n -e -ttt -i pflog0</nowiki>

== Troubleshooting ==

=== Rules not matching ===
* Verify rule order
* Check for quick rules
* Inspect active rules instead of GUI configuration

 <nowiki>
pfctl -sr</nowiki>

=== NAT not working ===
* Confirm NAT rules are loaded
* Ensure outbound NAT mode is correct
* Check rule auto-generation

 <nowiki>
pfctl -s nat</nowiki>

=== Traffic blocked unexpectedly ===
* Inspect states
* Check floating rules
* Analyze logs in pflog

 <nowiki>
pfctl -s state</nowiki>

=== Performance degradation ===
* Check state table size
* Inspect table sizes
* Reset counters and monitor

 <nowiki>
pfctl -si</nowiki>

=== Rules disappear after reload ===
pfSense regenerates rules automatically. Manual pfctl changes are ephemeral and overwritten on reload or reboot.

== Useful links ==
* https://man.openbsd.org/pfctl
* https://man.openbsd.org/pf.conf
* https://docs.netgate.com/pfsense/en/latest/firewall/index.html
* https://www.freebsd.org/cgi/man.cgi?query=pfctl
* https://www.openbsd.org/faq/pf/