Control the packet filter (PF) and network address translation (NAT) device


pfctl [-AdeghmNnOoqRrvz] [-a anchor] [-D macro=value]
      [-F modifier ] [-f file] [-i interface] [-k host]
      [-p device] [-s modifier]
      [-t table -T command [address ...]] [-x level]

Runs on:



Load only the queue rules present in the rule file. Other rules and options are ignored.
-a anchor
Apply the -f, -F, and -s options only to the rules in the specified anchor. In addition to the main rule set, pfctl can load and manipulate additional rule sets by name, called anchors. The main rule set is the default anchor.

Anchors are referenced by name and may be nested, with the various components of the anchor path separated by slashes (/), similar to how file system hierarchies are laid out. The last component of the anchor path is where rule-set operations are performed.

Evaluation of anchor rules from the main rule set is described in the documentation for pf.conf.

Private tables can also be put inside anchors, either by having table statements in the pf.conf file that is loaded in the anchor, or by using regular table commands, as in:

# pfctl -a foo/bar -t mytable -T add

When a rule referring to a table is loaded in an anchor, the rule will use the private table if one is defined, and then fall back to the table defined in the main rule set, if there is one. This is similar to C rules for variable scope. It is possible to create distinct tables with the same name in the global rule set and in an anchor, but this is often bad design, and a warning is issued in that case.

-D macro=value
Define macro to be set to value on the command line. This overrides the definition of macro in the rule set.
Disable the packet filter.
Enable the packet filter.
-F modifier
Flush the filter parameters specified by modifier (which you can abbreviate):
-f file
Load the rules contained in the specified file. This file may contain macros, tables, options, and normalization, queueing, translation, and filtering rules. With the exception of macros and tables, the statements must appear in that order.

Specify - for the file to use standard input.

Include output helpful for debugging.
Display some help information.
-i interface
Restrict the operation to the given interface.
-k host
Kill all of the state entries originating from the specified host. You can specify a second -k option, which will kill all the state entries from the first host to the second host. For example, to kill all of the state entries originating from host:
# pfctl -k host

To kill all of the state entries from host1 to host2:

# pfctl -k host1 -k host2
Merge in explicitly given options without resetting those that are omitted. This option lets you modify single options without disturbing the others:
# echo "set loginterface fxp0" | pfctl -mf -
Load only the NAT rules present in the rule file. Other rules and options are ignored.
Don't actually load rules; just parse them.
(“Oh”) Load only the options present in the rule file. Other rules and options are ignored.
Enable the rule-set optimizer, which attempts to improve rule sets by removing rule duplication and making better use of rule ordering. Specifically, it does the following:

You can specify a second -o option to use the currently loaded rule set as a feedback profile to tailor the optimization of the quick rules to the actual network behavior.

Note: The rule-set optimizer modifies the rule set to improve performance. A side effect of the ruleset modification is that per-rule accounting statistics will have different meanings than before. If per-rule accounting is important (e.g. for billing purposes), either you shouldn't use the rule-set optimizer, or you should add a label field to all of the accounting rules to act as optimization barriers.

-p device
Use the device file device instead of the default, /dev/pf.
Print only errors and warnings.
Load only the filter rules present in the rule file. Other rules and options are ignored.
Perform reverse DNS lookups on states when displaying them.
-s modifier
Show the filter parameters specified by modifier (which you can abbreviate):
-T command [address ...]
Specify the command (which you can abbreviate) to apply to the table. The commands include:

For the add, delete, replace, and test commands, you can specify the list of addresses either directly on the command line and/or in an unformatted text file, using the -f flag. Comments starting with a # are allowed in the text file. With these commands, you can also use the -v option once or twice, in which case pfctl prints the detailed result of the operation for each individual address, prefixed by one of the following letters:

Each table maintains a set of counters that you can retrieve using the -v option. For example, the following commands define a wide-open firewall that keeps track of packets going to or coming from the OpenBSD FTP server. The following commands configure the firewall and send 10 pings to the FTP server:

# printf "table <test> { }\n \
      pass out to <test> keep state\n" | pfctl -f-
# ping -qc10

We can now use the table show command to output, for each address and packet direction, the number of packets and bytes that are being passed or blocked by rules referencing the table. The time at which the current accounting started is also shown with the Cleared line:

# pfctl -t test -vTshow
        Cleared:     Thu Feb 13 18:55:18 2003
        In/Block:    [ Packets: 0        Bytes: 0        ]
        In/Pass:     [ Packets: 10       Bytes: 840      ]
        Out/Block:   [ Packets: 0        Bytes: 0        ]
        Out/Pass:    [ Packets: 10       Bytes: 840      ]

Similarly, you can view global information about the tables by using the -v option twice with the -s Tables command. This displays the number of addresses on each table, the number of rules that reference the table, and the global packet statistics for the whole table:

# pfctl -vvsTables
--a-r-  test
    Addresses:   1
    Cleared:     Thu Feb 13 18:55:18 2003
    References:  [ Anchors: 0        Rules: 1        ]
    Evaluations: [ NoMatch: 3496     Match: 1        ]
    In/Block:    [ Packets: 0        Bytes: 0        ]
    In/Pass:     [ Packets: 10       Bytes: 840      ]
    In/XPass:    [ Packets: 0        Bytes: 0        ]
    Out/Block:   [ Packets: 0        Bytes: 0        ]
    Out/Pass:    [ Packets: 10       Bytes: 840      ]
    Out/XPass:   [ Packets: 0        Bytes: 0        ]

In this case, only one packet — the initial ping request — matched the table, but all packets passing as the result of the state are correctly accounted for. Reloading the table(s) or ruleset doesn't affect packet accounting in any way. The two XPass counters are incremented instead of the Pass counters when a “stateful” packet is passed but doesn't match the table anymore. This will happen in our example if someone were to flush the table while the ping command was running.

When used with a single -v, pfctl displays only the first line containing the table flags and name. The flags are defined as follows:

-t table
Specify the name of the table.
Produce more verbose output. If you specify a second -v, pfctl produces even more verbose output including rule set warnings. See above for its effect on table commands.
-x level
Set the debugging level to one of the following (which you can abbreviate):
Clear per-rule statistics.


The pfctl utility communicates with the packet filter device using the ioctl() or ioctl_socket() interface described in pf. It lets you configure rule sets and parameters and retrieve status information from the packet filter.

Packet filtering restricts the types of packets that pass through network interfaces entering or leaving the host based on filter rules as described in pf.conf. The packet filter can also replace addresses and ports of packets. Replacing source addresses and ports of outgoing packets is called NAT (Network Address Translation) and is used to connect an internal network (usually reserved address space) to an external one (the Internet) by making all connections to external hosts appear to come from the gateway. Replacing destination addresses and ports of incoming packets is used to redirect connections to different hosts and/or ports. A combination of both translations, bidirectional NAT, is also supported. Translation rules are described in the documentation for pf.conf.

The packet filter doesn't itself forward packets between interfaces. Forwarding can be enabled by setting the sysctl variables net.inet.ip.forwarding and/or net.inet6.ip6.forwarding to 1. Set them permanently in /etc/sysctl.conf.


Packet filter rules file.
Passive operating system fingerprint database.

See also:

pf, /etc/pf.conf, /etc/pf.os, sysctl

ftp-proxy in the NetBSD documentation at