In this tutorial we explain how to enable, configure and use the firewall in FreeBSD with PF Linux
What is PF?
PF (Packet Filter – Packet Filter) has been developed as a software firewall for FreeBSD systems with which we can create hundreds of rules that allow us to manage in a much more centralized way the access and behavior of all elements of the system.
Now we will see how to enable and configure pf in FreeBSD.
Step 1: Enable Firewall
Although pf is integrated into FreeBSD, we must add the following lines in the file /etc/rc.conf with the desired editor:
The lines to add are:
echo 'pf_enable="YES"' >> /etc/rc.conf echo 'pf_rules="/usr/local/etc/pf.conf"' >> /etc/rc.conf echo 'pflog_enable="YES"' >> /etc/rc.conf echo 'pflog_logfile="/var/log/pflog"' >> /etc/rc.conf
Once we add these lines, we save the changes using the Ctrl + O keys and exit the editor using Ctrl + X.
Step 2: Create Rules in /usr/local/etc/pf.conf
Once the previous lines have been added, we will access the file /usr/local/etc/pf.conf to create the rules that pf should read and which will be taken into account at the time of protection.
We access using some editor:
As it is a new file, the possibilities of rules are thousands, for this case, we can go to the following link and copy the rule, which applies to a web server, and paste it into our configuration file:
There we must take into account modify the network adapter in the ext_if field by the correct one in each case.
Something vital to keep in mind is that pf has a defined order to establish the rules and this is:
Macros must be defined before they are referenced in pf.conf
The tables provide a mechanism to increase the performance and flexibility of the rules
The options adjust the behavior of the packet filtering engine.
This rule protects internal machines against inconsistencies in Internet protocols and implementations.
Provides bandwidth control based on defined rules
This option specifies how the addresses should be mapped or redirected.
Offers a rule-based blocking
Once the rules are created, we save the changes using Ctrl + O and exit the editor using Ctrl + X.
Step 3: Enable PF Service
Then we will execute a series of commands to check and start the pf service in FreeBSD.
To verify the enabling status of pf we execute the line:
To start the pf service we run the following line:
service pf start
We check the service by executing:
service pf check
At this point we can also run any of the following options:
/etc/rc.d/pf checkpfctl -n -f /usr/local/etc/pf.conf
If we want to stop the pf service we run:
service pf stop
To restart the pf service:
service pf restart
If we're going to see the current status of the pf service:
service pf status
The pf firewall uses the pflog service to store and record all security events that occur in the system, the usage options are:
service pflog start service pflog stop service pflog restart
Step 4: How To Use PF on FreeBSD
It will be necessary to use the pfctl command to be able to visualize the set of pf rules and the configuration of the parameters, including the status information of the packet filter.
To see this information we execute the following:
pfctl -s rules
We can see how pf is a practical tool when working with the firewall on FreeBSD.