I came from iptables and still have the misfortune of needing to use that in my job. :) My favorite feature of pf is the configuration file, which is a human-r

I came from iptables and still have the misfortune of needing to use that in my job. :) My favorite feature of pf is the configuration file, which is a human-readable/writable file which sets the state in a consistent way, rather than iptable's preferred mechanism of using a bunch of CLI commands executed in just the right sequence. I want a guaranteed consistent state when I'm configuring firewalls across a fleet, and pf.conf makes that not only easy to achieve, but the default behavior. Just modify the conf file, copy that to all the boxes, reload pf, and your firewalls are all updated and guaranteed to be in the same state, regardless of whatever state they were in before. You can read the pf.conf file from top to bottom to figure out what's going to happen to any packet. All the rules are included right there. I would just read the man page for pf.conf which gives helpful examples (https://man.openbsd.org/pf.conf.5#EXAMPLES https://man.openbsd.org/pf.conf.5#EXAMPLES) as well as this resource: https://www.openbsd.org/faq/pf/config.html https://www.openbsd.org/faq/pf/config.html.