OpenBSD PF Firewall - Beginner Guide

OpenBSD PF Firewall - Beginner Guide

PF (Packet Filter) is OpenBSD's built-in firewall. It's enabled by default and blocks all incoming connections for your security.

How PF Works

By default, OpenBSD's PF firewall:
block in all - blocks all incoming connections
pass out all - allows all outgoing connections
This means: You can surf the web, send email, etc., but nobody can connect to your computer from the internet unless you explicitly allow it.

Basic PF Configuration

The main configuration file is /etc/pf.conf. Let's look at a simple example:

Example: Allow SSH Only

This configuration allows only SSH (port 22) connections from the internet, and allows everything else on your local network.

# /etc/pf.conf - simple SSH-only configuration
set skip on lo0  # Skip loopback interface
 
# Allow established connections and related traffic
pass in quick on egress proto tcp from any to any port 22  # Allow SSH
 
# Block everything else incoming
block in all

Example: Allow SSH + Web Server

This allows SSH (port 22) and web server (ports 80 and 443) from the internet.

# /etc/pf.conf - SSH and web server
set skip on lo0
 
# Allow established connections
pass in quick on egress proto tcp from any to any port { 22 80 443 }
 
# Block everything else
block in all

Enabling and Disabling PF

PF is enabled by default on OpenBSD boot.
To disable temporarily: pfctl -d
To re-enable: pfctl -e
To check status: pfctl -s rules - shows current rules
To reload configuration: pfctl -f /etc/pf.conf

Common Beginner Mistakes

Mistake 1: block in all without allowing SSH first.
Result: You lock yourself out! You can't connect via SSH.
Fix: Always allow SSH before adding block in all, or use a console cable.

Mistake 2: Syntax error in /etc/pf.conf.
Result: PF may not start, or rules won't work properly.
Fix: Use pfctl -n -f /etc/pf.conf to check for errors without loading.

Mistake 3: Forgetting to apply changes.
Result: Old rules still active.
Fix: Always run pfctl -f /etc/pf.conf after editing.

Want to see PF advanced rules? Proceed to Lesson 11: PF Advanced Rules.

Next: OpenBSD SSH Configuration - Beginner Guide

Article author: Arthur Isaev