PF syntax differences among OpenBSD, OS X and FreeBSD?
reddit / BSD

----------------------------------------------------------------------
z27 · 2015-08-11 09:45

Where I am working, we take care of a few FreeBSD servers (10.1),
while most of us use OS X desktops.

We would like to standardize on one firewall syntax, and we would
prefer to use PF. Its syntax just feels better and PF has been the
default OS X firewall since 10.7.

I know that FreeBSD's PF syntax has diverged a bit from the original
OpenBSD's PF (FreeBSD 9.X and later uses the same version of PF as
OpenBSD 4.5).

But I could not find anywhere how OS X's PF syntax differs from
OpenBSD's.

Since OS X was based on FreeBSD, is its PF syntax the same as
FreeBSD's, or closer to FreeBSD's than OpenBSD's?

Would a gui frontend like
[murusfirewall](http://www.murusfirewall.com) help at least a little
to generate PF rules valid for FreeBSD?

---

Update: It seems that OS X's PF version has only minor differences
from FreeBSD's:

    PF in OS X, however, appears to be based on the FreeBSD port of
PF,
    but with some notable additions (see below). Like FreeBSD 9.X and
later,
    OS X appears to use the same version of PF as OpenBSD 4.5.

See: https://pleiades.ucsc.edu/hyades/PF_on_Mac_OS_X

----------------------------------------------------------------------
pyvpx · 2015-08-11 09:57

Disclaimer: I have not used pf on anything but OpenBSD.

I believe FreeBSD and OS X use older versions of PF, thus it would be
helpful to read the pf man page of the version it imported. If FreeBSD
is using pf from OpenBSD 4.8, then the 4.8 man page would be helpful.

I am unaware of any actual syntax difference in FreeBSD, but if there
is...it will be extremely minimal and easy to come across and you
build your ruleset.

----------------------------------------------------------------------
[deleted] · 2015-08-11 11:16

[deleted]

----------------------------------------------------------------------
z27 · 2015-08-11 11:44

Thanks. This [man page](https://developer.apple.com/library/mac/docume
ntation/Darwin/Reference/ManPages/man5/pf.conf.5.html#//apple_ref/doc/
man/5/pf.conf) says:

    HISTORY
         The pf.conf file format first appeared in OpenBSD 3.0.

I guess that does not necessarily means it follow 3.0 syntax, though.

----------------------------------------------------------------------
daemonpenguin · 2015-08-11 12:58

You should probably read Book of PF. It covers PF syntax in detail and
provides notes about how the syntax differs on FreeBSD, OpenBSD and
other implementations. https://www.nostarch.com/pf3

----------------------------------------------------------------------
owat · 2015-08-11 13:22

Depends on version http://lifeisabug.com/the-current-state-of-
openbsds-packet-filter-pf-in-freebsd/

----------------------------------------------------------------------
z27 · 2015-08-11 13:25

Nice. I did not know about the third edition (2014). I shall
definitely get it. Thank you.

----------------------------------------------------------------------
Xipher · 2015-08-11 14:20

It's definitely changed since then.

----------------------------------------------------------------------
Xipher · 2015-08-11 14:27

FreeBSD still has the separate NAT, BINAT, and RDR rules. Also uses
AltQ, and doesn't have match action. Those are the ones I can recall
at the moment, I believe their might be some others as well.

----------------------------------------------------------------------
[deleted] · 2015-08-11 17:46

[deleted]

----------------------------------------------------------------------
liquoranwhores · 2015-08-12 02:37

http://www.fwbuilder.org/ would allow you to write the same rule set
and output it for both OpenBSD & FreeBSD. I've used it in the past
with decent results.

----------------------------------------------------------------------
captain_chao · 2015-08-13 01:43

I tried it sometime last year. I honestly found it faster to just plow
through The Book of Pf. Also, I don't think it has been updated in a
long while.

----------------------------------------------------------------------
krokounleashed · 2015-09-08 12:24

PF on OSX is newer than the FreeBSD pf but far from current on
OpenBSD. And I remember that Apple modified it to make it fit better
for daily usage of an average user. That's the last stuff I found,
however this an very old article but I doubt Apple has changed much
since: http://www.callfortesting.org/macpf/