I am currently trying to get familiar with the basics of PF on FreeBSD.

I am trying to setup the most basic example from the PF chapter in the FreeBSD handbook, the simple bruteforce rules:

block quick from <bruteforce>
pass inet proto tcp from any to $localnet port $tcp_services \
    flags S/SA keep state \
    (max-src-conn 100, max-src-conn-rate 15/5, \
    overload <bruteforce> flush global)

What is the difference between this, and only setting it up as follows:

block quick from <bruteforce>
pass quick proto tcp to port $tcp_services \
    flags S/SA keep state \
    (max-src-conn 100, max-src-conn-rate 15/5, \
    overload <bruteforce> flush global)

While doing this I was going to setup $localnet, which in this example is done like this:

ext_if = "xl0"  # macro for external interface - use tun0 for PPPoE
int_if = "xl1"  # macro for internal interface
localnet = $int_if:network

Which brought to surface that I lack some fundamental understanding of how to differentiate between external and internal interface.

In my case if I run ifconfig, I get vtnet0, lo0 and pflog0.

So I do not have 2 interfaces like the example, and my system is not set up as a firewall between the internet and my local network.

If I only got one interface, is this my external, or internal? How would I use the example from the docs in my case?


If you only have only one NIC, you are using PF just as a "host firewall". You don't have an internal network. You don't need things like NAT, Forwarding etc. Just allow the incoming services and the valid outgoing traffic and you are done.

  • I see, so the terms "external interface" and "internal interface" do not even apply, making a $localnet declaration unnecessary, if I understand correctly? And using pass quick proto tcp to port $tcp_services..., as I did, would be the right/working translation of the example? – Jessica Nowak Apr 22 '17 at 15:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.