Textbook in PDF format The OpenBSD packet filter, PF, is central to the OpenBSD and FreeBSD network toolbox. With more services placing high demands on bandwidth and an increasingly hostile Internet environment, no sysadmin can afford to be without PF expertise. The fourth edition of The Book of PF covers the most up-to-date developments in PF, including new content on IPv6, dual stack configurations, the “queues and priorities” traffic-shaping system, NAT and redirection, wireless networking, spam fighting, failover provisioning, logging, and more. You’ll also learn how to: Create rulesets for all kinds of network traffic, IPv4 and IPv6 both, whether crossing a simple LAN, hiding behind NAT, traversing DMZs, or spanning bridges or wider networks Set up wireless networks with access points, and lock them down using authpf and special access restrictions Maximize flexibility and service availability via CARP, relayd, and redirection Build adaptive firewalls to proactively defend against attackers and spammers Harness OpenBSD’s latest traffic-shaping system to keep your network responsive, or use ALTQ and Dummynet configurations on FreeBSD to full effect Stay in control of your traffic with monitoring and visualization tools (including NetFlow) The Book of PF is the essential guide to building a secure network with PF. With a little effort and this book, you’ll be well prepared to unlock PF’s full potential. Covers OpenBSD 7.x, FreeBSD 14.x, and NetBSD 10.x Here is a brief rundown of what you will find in this book: • Chapter 1: Building the Network You Need Walks through basic networking concepts, gives a short overview of PF’s history, and provides some pointers on how to adjust to the BSD way if you are new to this family of operating systems. Read this chapter first to get a sense of how to work with BSD systems. • Chapter 2: PF Configuration Basics Shows how to enable PF on your system and covers a very basic ruleset for a single machine. This chapter is fairly crucial, since all the later configurations are based on the one we build here. • Chapter 3: Into the Real World Builds on the single-machine configuration in Chapter 2 and leads you through the basics of setting up a gateway to serve as a point of contact between separate networks. By the end of Chapter 3, you will have built a configuration that is fairly typical for a home or small office network, and have some tricks up your sleeve to make network management easier. You’ll also get an early taste of how to handle services with odd requirements, such as FTP, as well as some tips on how to make your network troubleshooting-friendly by catering to some of the frequently less understood Internet protocols and services. • Chapter 4: Wireless Networks Made Easy Walks you through adding wireless networking to your setup. The wireless environment presents some security challenges, and by the end of this chapter, you may find yourself with a wireless network with access control and authentication via authpf. Some of the information is likely to be useful in wired environments, too. • Chapter 5: Bigger or Trickier Networks Tackles the situation where you introduce servers and services that need to be accessible from outside your own network. By the end of this chapter, you may have a network with one or several separate subnets and DMZs, and you will have tried your hand at a couple of different load-balancing schemes via redirections and relayd in order to improve service quality for your users. • Chapter 6: Turning the Tables for Proactive Defense Introduces some of the tools in the PF tool chest for dealing with attempts at undesirable activity and shows how to use them productively. We deal with brute-force password-guessing attempts and other network flooding, as well as the antispam tool spamd, the OpenBSD spam deferral daemon. This chapter should make your network a more pleasant one for legitimate users and less welcoming to those with less-than-good intentions. • Chapter 7: Traffic Shaping with Queues and Priorities Introduces traffic shaping via the priorities and queues systems introduced in OpenBSD 5.5. This chapter also contains tips on how to convert earlier ALTQ-based setups to the new system, as well as information on setting up and maintaining ALTQ on operating systems where the newer queueing system is not available. This chapter should leave you with better resource utilization by adapting traffic shaping to your network needs. • Chapter 8: Redundancy and Resource Availability Shows how to create redundant configurations, with CARP configurations for both failover and load balancing. This chapter should give you insight into how to create and maintain a highly available, redundant, CARP-based configuration. • Chapter 9: Logging, Monitoring, and Statistics Explains PF logs. You’ll learn how to extract and process log and statistics data from your PF configuration with tools in the base system as well as optional packages. We’ll also discuss NetFlow and SNMP-based tools. • Chapter 10: Getting Your Setup Just Right Walks through various options that will help you tune your setup. It ties together the knowledge you have gained from the previous chapters with a ruleset debugging tutorial. • Appendix A: Resources Provides an annotated list of print and online literature and other resources you may find useful as you expand your knowledge of PF and networking topics. • Appendix B: A Note on Hardware Support Gives an overview of some of the issues involved in creating a first-rate tool as free software. Each chapter in this book builds on the previous one. While as a free being you can certainly skip around, it may be useful to read through chapters in sequence. For a number of reasons, OpenBSD is my favorite operating system. My main environment for writing this book is dominated by OpenBSD systems running either recent snapshots, the odd -stable system, and every now and then a locally built -current. This means that the main perspective in the book is the world as seen from the command line in OpenBSD 7.8. I dabble in FreeBSD and its cousin macOS as well, and in order to make the book useful for FreeBSD users, I have taken care to show the proper FreeBSD way in the cases where the systems differ. The emphasis is, as always, on building a useful configuration for your environment