pf

pf is OpenBSD’s packet filter, and it sits at the edge of the networks we build. What sets it apart is a legible ruleset, more than throughput or the number of features.

Why we still choose it

We hold firewall configuration to one test: a competent engineer who has never seen it can read it aloud in a meeting, and everyone agrees on what it does. Almost every long-lived configuration fails. One we inherited recently had been appended to since 2011, ran to nine hundred lines, and included a comment reading # temporary — remove after migration.

pf is designed to pass. Macros let you give things your own names, tables turn a set of addresses into a single noun, and the syntax is close enough to English that a rule read aloud means what it says. pf reloads the ruleset atomically. Evaluation follows one rule: the last match wins, unless a rule says quick.

How we run it

The ruleset lives in the same repository as everything else and changes through pull requests. A rule with no author and no rationale does not survive review, which is how the “temporary” rules get removed. State tracking with connection-rate limits and overload tables handles brute-force protection in the firewall itself.

Where it falls short

Using pf means running BSD at the edge, which is a fair objection for a Linux-only team; nftables is a reasonable alternative with much of the same approach. pf works at layers 3 and 4 only, with no deep packet inspection and no TLS interception. Inside a hyperscaler it mostly duplicates the provider’s own filtering.

The PF User’s Guide is the best firewall documentation we know of, and we recommend reading all of it.

A note on the mark

pf has no logo of its own, since it is a component of OpenBSD rather than a separate project, so it carries OpenBSD’s. The blowfish is Puffy, the project’s mascot since 1996. He is drawn as fine line-art, so he gets a little more room than the other marks on this site and is shown here at a size where the detail survives.