fwb_pf(1)

💖 fwb_pf — like, the manual page, but make it make sense 💖

okay bestie, welcome to fwb_pf(1), a page straight out of the Firewall Builder manual. grab a snack, we're learning the OpenBSD packet filter compiler and it's lowkey iconic 🎀

---

✨ NAME ✨

fwb_pf — the policy compiler for the OpenBSD packet filter, aka pf. yes, that pf. the one everyone's obsessed with. 🦋

---

🌸 SYNOPSIS 🌸

fwb_pf [-vVx] [-d wdir] [-o output.fw] [-i] -f data_file.xml object_name

like, that's the whole vibe. flags first, then the file, then the object name. periodt. 💅

---

🫶 DESCRIPTION 🫶

So. fwb_pf is one of the firewall policy compiler components that live inside Firewall Builder (peep fwbuilder(1) if you wanna meet the parent 🥺). This lil guy generates code for the OpenBSD Packet Filter (pf). It reads your object definitions and your firewall description out of the data file you point it at with the -f option, and then it spits out pf configuration files plus a firewall activation script. slay. ✨

Every file it makes starts with the name of the firewall object. The firewall activation script gets the extension .fw, and it's just a simple shell script that:

1. flushes the current policy,
2. loads the new filter and nat rules,
3. activates pf.

The PF configuration file name also starts with the name of the firewall object, plus -pf.conf. The NAT configuration file name starts with the name of the firewall object too, plus -nat.conf. So if your firewall object is named myfirewall, the compiler creates three files:

myfirewall.fw
myfirewall-pf.conf
myfirewall-nat.conf

three files, one firewall, no notes. 🧚

The data file and the name of the firewall object must be specified on the command line — those are non-negotiable bestie. Everything else? optional. 🙈

---

👑 OPTIONS 👑

• -f FILE — names the data file that's getting processed. the whole reason we're here. 💜
• -o output.fw — names the output file. you pick it, it writes it. ✨
• -d wdir — sets the working directory. the compiler drops the firewall activation script and the PF configuration files in there. if you skip this one, everything lands in the current working directory instead. no drama. 🎀
• -v — be verbose: the compiler prints diagnostic messages while it's working. it's giving "narrating its own life". 🗣️
• -V — print the version number and quit. that's it, that's the whole job. 👑
• -i — when this flag shows up, the last argument on the command line is supposed to be the firewall object ID instead of its name. plot twist. 😭
• -x — generate debugging information while working. ⚠️ this one is intended for debugging only and may produce lots of cryptic messages. you have been warned, bestie. 💀

---

🌈 NOTES 🌈

Support for PF was introduced in version 1.0.1 of Firewall Builder. baby's first pf support, we love to see it. 🍼

Supported features — the stuff it can do:

• both pf.conf and nat.conf files are generated ✨
• negation in policy and NAT rules
• grouping in "from", "to" and ports using the '{' '}' syntax
• if the checkbox "Scrub" is checked in the rule options dialog, and the rule's action is Accept, the compiler generates two (almost) identical rules: the first with action 'scrub' and the second with action 'pass quick'
• stateful inspection in an individual rule can be turned off in the rule options dialog. by default the compiler adds "keep state" or "modulate state" to each rule with action 'pass' — yes, it's doing that automatically, yes it's on purpose 💅
• the rule options dialog gives you a choice of icmp or tcp rst replies for rules with action "Reject"
• the compiler adds the flag "allow-opts" if a match on ip options is needed
• the compiler can generate rules matching on TCP flags
• the compiler can generate a script adding ip aliases for NAT rules using addresses that do not belong to any interface of the firewall
• the compiler always adds the rule "block quick all" at the very bottom of the script to ensure a "block all by default" policy — even if the policy is empty. safety queen. 🛡️
• Address ranges in both policy and NAT

Features that are not supported (yet) — the "coming soon, maybe, don't rush me" list:

• custom services

What will not be supported (at least not anytime soon) — the hard no list:

• policy routing

---

🔗 URL 🔗

The Firewall Builder home page is located at the following URL:

http://www.fwbuilder.org/

go look, it's cute. 🌸

---

💀 BUGS 💀

Please report bugs using the bug tracking system on SourceForge:

http://sourceforge.net/tracker/?group_id=5314&atid=105314

found a bug? don't suffer in silence, bestie, drop it in the tracker. 🙏

---

🫶 SEE ALSO 🫶

fwbuilder(1), fwb_ipt(1), fwb_ipf(1)

---

and that's the whole page, bestie! this was FWB's fwb_pf(1) manual page, and yeah — it's part of the Firewall Builder family of pages. go forth and compile, you absolute main character. 💖✨🎀