pf

pf is OpenBSD’s packet filter, and it sits at the edge of the networks we build. Its distinguishing feature is not throughput or feature count. It is that the ruleset is legible.

Why we still choose it

Because a firewall configuration should pass one test: a competent engineer who has never seen it can read it aloud in a meeting, and everyone agrees on what it does. Almost every long-lived configuration fails that test — we inherited one recently that had been appended to since 2011, nine hundred lines, with a comment reading # temporary — remove after migration.

pf is built for the higher bar. Macros give things your names, tables make a set of addresses a noun, and the syntax is close enough to English that reading a rule out loud is literal. Reloads are atomic, so there is no window where half the old policy and half the new one are in force. Evaluation is one rule: last match wins, unless it says quick.

How we run it

The ruleset lives in the same repository as everything else and changes through pull requests. A rule with no author and no rationale does not survive review, which is exactly what kills the “temporary” rules. State tracking with connection-rate limits and overload tables handles brute-force protection in the firewall itself.

The honest limit

It means running BSD at the edge, which is a legitimate objection for a Linux-only team — nftables is a reasonable answer with much of the same spirit. pf is layer 3 and 4 only: no deep packet inspection, no TLS interception. And inside a hyperscaler it is mostly redundant with the provider’s own filtering.

The PF User’s Guide is the best firewall documentation we know of, and worth reading end to end.

A note on the mark

pf has no logo of its own — it is a component of OpenBSD rather than a separate project — so it carries OpenBSD’s. The blowfish is Puffy, the project’s mascot since 1996, and he is drawn as fine line-art, so he is given a little more room than the other marks on this site and shown here at a size where the detail survives.