PFSENSE - PFCTL Basic Usage - Revision history

Admin: Text replacement - "Category:Wiki" to "Category:Wiki '''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]''''' "

2026-01-17T07:05:04Z

Text replacement - "Category:Wiki" to "Category:Wiki '''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]''''' "

← Older revision		Revision as of 07:05, 17 January 2026
Line 1:		Line 1:
	[[Category:Wiki]]		[[Category:Wiki]]

			'''''[https://it-arts.net/index.php/Category:Wiki Return to Wiki Index]'''''


	== Packet Filter architecture ==		== Packet Filter architecture ==

Admin at 19:29, 12 January 2026

2026-01-12T19:29:54Z

← Older revision		Revision as of 19:29, 12 January 2026
Line 1:		Line 1:
	[[Category:~~wiki~~]]		[[Category:Wiki]]

	== Packet Filter architecture ==		== Packet Filter architecture ==

Admin at 19:28, 12 January 2026

2026-01-12T19:28:27Z

← Older revision		Revision as of 19:28, 12 January 2026
Line 182:		Line 182:
	pfSense regenerates rules automatically. Manual pfctl changes are ephemeral and overwritten on reload or reboot.		pfSense regenerates rules automatically. Manual pfctl changes are ephemeral and overwritten on reload or reboot.

	=== Useful links ===		== Useful links ==
	* https://man.openbsd.org/pfctl		* https://man.openbsd.org/pfctl
	* https://man.openbsd.org/pf.conf		* https://man.openbsd.org/pf.conf

Admin at 19:28, 12 January 2026

2026-01-12T19:28:11Z

Show changes

Admin at 07:07, 14 December 2025

2025-12-14T07:07:25Z

← Older revision		Revision as of 07:07, 14 December 2025
Line 7:		Line 7:
	The `pfctl` command interacts with the PF firewall by managing states, rules, queues, and NAT configuration. It is a crucial tool for pfSense administrators who need to fine-tune firewall settings, troubleshoot issues, or examine the current state of the firewall.		The `pfctl` command interacts with the PF firewall by managing states, rules, queues, and NAT configuration. It is a crucial tool for pfSense administrators who need to fine-tune firewall settings, troubleshoot issues, or examine the current state of the firewall.

	~~###~~ General Syntax		General Syntax

	<nowiki>		<nowiki>
Line 28:		Line 28:
	States: 1454 active, 220 new</nowiki>		States: 1454 active, 220 new</nowiki>

	~~###~~ Displaying Firewall Rules		Displaying Firewall Rules

	To display all active rules, run:		To display all active rules, run:
Line 44:		Line 44:
	This will show only the NAT rules configured in PF.		This will show only the NAT rules configured in PF.

	~~###~~ Viewing Active States and Connections		Viewing Active States and Connections

	To view the list of active states or connections, use:		To view the list of active states or connections, use:
Line 59:		Line 59:
	Each line represents an established or related connection with source and destination IPs and ports.		Each line represents an established or related connection with source and destination IPs and ports.

	~~###~~ Flushing Rules and States		Flushing Rules and States

	To clear the active states (flush states), use the following command:		To clear the active states (flush states), use the following command:
Line 75:		Line 75:
	This command removes the entire ruleset, effectively disabling filtering until new rules are loaded.		This command removes the entire ruleset, effectively disabling filtering until new rules are loaded.

	~~###~~ Reloading the pf Configuration		Reloading the pf Configuration

	To reload the PF configuration after editing `/etc/pf.conf` or after changes in the firewall rules, use:		To reload the PF configuration after editing `/etc/pf.conf` or after changes in the firewall rules, use:
Line 84:		Line 84:
	This will reapply the entire configuration, ensuring the latest rules are in effect.		This will reapply the entire configuration, ensuring the latest rules are in effect.

	~~###~~ Enabling and Disabling the Firewall		Enabling and Disabling the Firewall

	You can temporarily disable the PF firewall with:		You can temporarily disable the PF firewall with:
Line 126:		Line 126:
	pfctl -vv -s rules</nowiki>		pfctl -vv -s rules</nowiki>

	~~###~~ Monitoring Packets with pfctl		Monitoring Packets with pfctl

	You can also monitor packet counters and match statistics with:		You can also monitor packet counters and match statistics with:
Line 155:		Line 155:
	This command shows the NAT states, including address translations and port forwarding rules. You can also use pfctl to apply NAT settings dynamically after modifications in the `/etc/pf.conf` file.		This command shows the NAT states, including address translations and port forwarding rules. You can also use pfctl to apply NAT settings dynamically after modifications in the `/etc/pf.conf` file.

	~~###~~ Controlling Packet Queueing and Limitations		Controlling Packet Queueing and Limitations

	You can manage packet queueing for traffic shaping and bandwidth control by using:		You can manage packet queueing for traffic shaping and bandwidth control by using:
Line 167:		Line 167:
	pfctl -f /etc/pf.conf</nowiki>		pfctl -f /etc/pf.conf</nowiki>

	~~###~~ Viewing Anchor Rules		Viewing Anchor Rules

	In pfSense, you can configure rules that act as anchors, allowing for more modular configurations. To list all anchor rules, use:		In pfSense, you can configure rules that act as anchors, allowing for more modular configurations. To list all anchor rules, use:

Admin at 07:06, 14 December 2025

2025-12-14T07:06:15Z

Show changes

Admin: Created page with "Category:Wiki == pfctl Command Overview == The `pfctl` command interacts with the PF firewall by managing states, rules, queues, and NAT configuration. It is a crucial tool for pfSense administrators who need to fine-tune firewall settings, troubleshoot issues, or examine the current state of the firewall. ### General Syntax pfctl [options] The options provide the functionality for various tasks such as listing rules, monitoring states, and man..."

2025-12-14T07:05:50Z

Created page with "Category:Wiki == pfctl Command Overview == The `pfctl` command interacts with the PF firewall by managing states, rules, queues, and NAT configuration. It is a crucial tool for pfSense administrators who need to fine-tune firewall settings, troubleshoot issues, or examine the current state of the firewall. ### General Syntax <nowiki> pfctl [options]</nowiki> The options provide the functionality for various tasks such as listing rules, monitoring states, and man..."

New page

[[Category:Wiki]]

== pfctl Command Overview ==

The `pfctl` command interacts with the PF firewall by managing states, rules, queues, and NAT configuration. It is a crucial tool for pfSense administrators who need to fine-tune firewall settings, troubleshoot issues, or examine the current state of the firewall.

### General Syntax

<nowiki>
pfctl [options]</nowiki>

The options provide the functionality for various tasks such as listing rules, monitoring states, and managing filters.

== Viewing Firewall Information ==

To view general information about the firewall, including statistics about the packet filter (PF), you can run:

<nowiki>
pfctl -s info</nowiki>

This command displays details such as the number of rules, states, packets processed, and the status of PF. Example output might look like:

<nowiki>
Status: Enabled for 56 days 2 hours 31 minutes
Filters: 8 rules
States: 1454 active, 220 new</nowiki>

### Displaying Firewall Rules

To display all active rules, run:

<nowiki>
pfctl -sr</nowiki>

This shows the entire ruleset in use by PF, which could include rules for filtering traffic, NAT, and queueing.

If you want to filter and see only specific types of rules (such as NAT rules), you can use:

<nowiki>
pfctl -sn</nowiki>

This will show only the NAT rules configured in PF.

### Viewing Active States and Connections

To view the list of active states or connections, use:

<nowiki>
pfctl -ss</nowiki>

This command displays active states (connections) in the firewall, which could be essential for monitoring real-time traffic or troubleshooting connectivity issues. For example:

<nowiki>
TCP 192.168.1.100:12345 -> 93.184.216.34:80
TCP 192.168.1.101:34567 -> 216.58.204.14:443</nowiki>

Each line represents an established or related connection with source and destination IPs and ports.

### Flushing Rules and States

To clear the active states (flush states), use the following command:

<nowiki>
pfctl -F states</nowiki>

This is useful when you need to reset all active connections, such as after a change in firewall rules.

To flush (clear) all rules from the firewall, use:

<nowiki>
pfctl -F rules</nowiki>

This command removes the entire ruleset, effectively disabling filtering until new rules are loaded.

### Reloading the pf Configuration

To reload the PF configuration after editing `/etc/pf.conf` or after changes in the firewall rules, use:

<nowiki>
pfctl -f /etc/pf.conf</nowiki>

This will reapply the entire configuration, ensuring the latest rules are in effect.

### Enabling and Disabling the Firewall

You can temporarily disable the PF firewall with:

<nowiki>
pfctl -d</nowiki>

This turns off the firewall, which might be useful for debugging or performing maintenance. To enable the firewall again:

<nowiki>
pfctl -e</nowiki>

It's important to be cautious when using these commands, as disabling the firewall could expose the system to potential security risks.

== Managing IP Blocklists ==

You can dynamically manage IP blocklists using pfctl. For example, to add an IP address to a blocklist (such as blocking a malicious IP), use the following command:

<nowiki>
pfctl -t blocklist -T add 192.168.1.100</nowiki>

This command adds the IP address `192.168.1.100` to a predefined table called `blocklist`. To remove an IP from the blocklist:

<nowiki>
pfctl -t blocklist -T delete 192.168.1.100</nowiki>

Tables can be defined in the `/etc/pf.conf` configuration file, and the `-t` option is used to specify the table, while the `-T` option manages entries within that table.

== Debugging pfctl Output ==

If you need more detailed information for debugging purposes, you can add verbosity to any pfctl command. For example, to display detailed information about rules:

<nowiki>
pfctl -v -s rules</nowiki>

The `-v` flag increases verbosity, showing additional information about the rules, including rule match statistics and more.

To debug rule matching for a specific source or destination, use the `-vv` flag for even more detailed output:

<nowiki>
pfctl -vv -s rules</nowiki>

### Monitoring Packets with pfctl

You can also monitor packet counters and match statistics with:

<nowiki>
pfctl -s stats</nowiki>

This will provide statistics on the number of packets that matched a specific rule, the number of packets dropped, passed, or rejected, and more. Example output might look like:

<nowiki>
match 2345 pass 1432 block 80
total 5800</nowiki>

This is useful for assessing the impact of specific firewall rules.

== Managing NAT Rules ==

To manage Network Address Translation (NAT) settings, pfctl provides an option to list NAT rules:

<nowiki>
pfctl -sn</nowiki>

To view NAT statistics, use:

<nowiki>
pfctl -s nat</nowiki>

This command shows the NAT states, including address translations and port forwarding rules. You can also use pfctl to apply NAT settings dynamically after modifications in the `/etc/pf.conf` file.

### Controlling Packet Queueing and Limitations

You can manage packet queueing for traffic shaping and bandwidth control by using:

<nowiki>
pfctl -sq</nowiki>

This command lists all the configured queues and their current status, including packet counts and throughput. To add or modify queue settings, you would typically edit the `/etc/pf.conf` file and then reload the configuration using:

<nowiki>
pfctl -f /etc/pf.conf</nowiki>

### Viewing Anchor Rules

In pfSense, you can configure rules that act as anchors, allowing for more modular configurations. To list all anchor rules, use:

<nowiki>
pfctl -sa</nowiki>

This will show all loaded anchors and the rules associated with each anchor.