3 ms·
> The pf firewall is much easier to use with confidence than iptables Tell me more! I cut my teeth on ipchains/iptables back in the early 90's, and feel very
by clipradiowallet 5y ago
> The pf firewall is much easier to use with confidence than iptables
Tell me more! I cut my teeth on ipchains/iptables back in the early 90's, and feel very familiar with it. That said, I know that doesn't mean it's the best/easiest at all. I've tried to grok Pf once or twice, but never ended up getting very far. I wanted to ask you if you began with Pf, or if you came from something else? More or less, I'm trying to figure out if Pf was difficult for me just because it wasn't my first.
- cpach 5y agoFWIW: No Starch Press has a book about PF. I haven’t read it myself, but it might be worth having a look at. https://mwl.io/archives/2232 https://mwl.io/archives/2232
- hellcow 5y agoI came from iptables and still have the misfortune of needing to use that in my job. :) My favorite feature of pf is the configuration file, which is a human-readable/writable file which sets the state in a consistent way, rather than iptable's preferred mechanism of using a bunch of CLI commands executed in just the right sequence. I want a guaranteed consistent state when I'm configuring firewalls across a fleet, and pf.conf makes that not only easy to achieve, but the default behavior. Just modify the conf file, copy that to all the boxes, reload pf, and your firewalls are all updated and guaranteed to be in the same state, regardless of whatever state they were in before. You can read the pf.conf file from top to bottom to figure out what's going to happen to any packet. All the rules are included right there. I would just read the man page for pf.conf which gives helpful examples (https://man.openbsd.org/pf.conf.5#EXAMPLES https://man.openbsd.org/pf.conf.5#EXAMPLES) as well as this resource: https://www.openbsd.org/faq/pf/config.html https://www.openbsd.org/faq/pf/config.html.