PFSENSE - PFCTL Basic Usage

The `pfctl` command is a powerful tool for managing the packet filter (PF) in pfSense, providing advanced capabilities for controlling, monitoring, and debugging firewall rules and states. This documentation covers advanced usage scenarios with examples for better understanding.

pfctl Command Overview

The `pfctl` command interacts with the PF firewall by managing states, rules, queues, and NAT configuration. It is a crucial tool for pfSense administrators who need to fine-tune firewall settings, troubleshoot issues, or examine the current state of the firewall.

General Syntax

pfctl [options]

The options provide the functionality for various tasks such as listing rules, monitoring states, and managing filters.

Viewing Firewall Information

To view general information about the firewall, including statistics about the packet filter (PF), you can run:

pfctl -s info

This command displays details such as the number of rules, states, packets processed, and the status of PF. Example output might look like:

Status: Enabled for 56 days 2 hours 31 minutes
Filters: 8 rules
States: 1454 active, 220 new

Displaying Firewall Rules

To display all active rules, run:

pfctl -sr

This shows the entire ruleset in use by PF, which could include rules for filtering traffic, NAT, and queueing.

If you want to filter and see only specific types of rules (such as NAT rules), you can use:

pfctl -sn

This will show only the NAT rules configured in PF.

Viewing Active States and Connections

To view the list of active states or connections, use:

pfctl -ss

This command displays active states (connections) in the firewall, which could be essential for monitoring real-time traffic or troubleshooting connectivity issues. For example:

TCP 192.168.1.100:12345 -> 93.184.216.34:80
TCP 192.168.1.101:34567 -> 216.58.204.14:443

Each line represents an established or related connection with source and destination IPs and ports.

Flushing Rules and States

To clear the active states (flush states), use the following command:

pfctl -F states

This is useful when you need to reset all active connections, such as after a change in firewall rules.

To flush (clear) all rules from the firewall, use:

pfctl -F rules

This command removes the entire ruleset, effectively disabling filtering until new rules are loaded.

Reloading the pf Configuration

To reload the PF configuration after editing `/etc/pf.conf` or after changes in the firewall rules, use:

pfctl -f /etc/pf.conf

This will reapply the entire configuration, ensuring the latest rules are in effect.

Enabling and Disabling the Firewall

You can temporarily disable the PF firewall with:

pfctl -d

This turns off the firewall, which might be useful for debugging or performing maintenance. To enable the firewall again:

pfctl -e

It's important to be cautious when using these commands, as disabling the firewall could expose the system to potential security risks.

Managing IP Blocklists

You can dynamically manage IP blocklists using pfctl. For example, to add an IP address to a blocklist (such as blocking a malicious IP), use the following command:

pfctl -t blocklist -T add 192.168.1.100

This command adds the IP address `192.168.1.100` to a predefined table called `blocklist`. To remove an IP from the blocklist:

pfctl -t blocklist -T delete 192.168.1.100

Tables can be defined in the `/etc/pf.conf` configuration file, and the `-t` option is used to specify the table, while the `-T` option manages entries within that table.

Debugging pfctl Output

If you need more detailed information for debugging purposes, you can add verbosity to any pfctl command. For example, to display detailed information about rules:

pfctl -v -s rules

The `-v` flag increases verbosity, showing additional information about the rules, including rule match statistics and more.

To debug rule matching for a specific source or destination, use the `-vv` flag for even more detailed output:

pfctl -vv -s rules

Monitoring Packets with pfctl

You can also monitor packet counters and match statistics with:

pfctl -s stats

This will provide statistics on the number of packets that matched a specific rule, the number of packets dropped, passed, or rejected, and more. Example output might look like:

match 2345 pass 1432 block 80
total 5800

This is useful for assessing the impact of specific firewall rules.

Managing NAT Rules

To manage Network Address Translation (NAT) settings, pfctl provides an option to list NAT rules:

pfctl -sn

To view NAT statistics, use:

pfctl -s nat

This command shows the NAT states, including address translations and port forwarding rules. You can also use pfctl to apply NAT settings dynamically after modifications in the `/etc/pf.conf` file.

Controlling Packet Queueing and Limitations

You can manage packet queueing for traffic shaping and bandwidth control by using:

pfctl -sq

This command lists all the configured queues and their current status, including packet counts and throughput. To add or modify queue settings, you would typically edit the `/etc/pf.conf` file and then reload the configuration using:

pfctl -f /etc/pf.conf

Viewing Anchor Rules

In pfSense, you can configure rules that act as anchors, allowing for more modular configurations. To list all anchor rules, use:

pfctl -sa

This will show all loaded anchors and the rules associated with each anchor.

Conclusion

The `pfctl` command in pfSense is an advanced and powerful tool for managing the PF firewall. Whether you're managing states, modifying rules dynamically, debugging firewall traffic, or configuring NAT and queues, `pfctl` provides the flexibility and control needed for sophisticated network security management. By mastering `pfctl`, administrators can fine-tune their pfSense configurations to meet their unique security and networking requirements.