pf – DragonFly BSD Digest

Lazy Reading for 2025/09/28

Justin Sherrill — Sun, 28 Sep 2025 12:10:57 +0000

Done while traveling.

The $69 Billion Domino Effect. Another reason for open source. (via)
pf reconsolidation. I’d hope for One True pf.
curl is in your car. (via)
How Social Media shortens your life.
Before UNIX there was MULTICS. Before MULTICS there was GECOS, and there’s still people hacking on it. (via)
Incidentally, there’s a “GECOS field” in /etc/passwd that comes from that, I think.
No leap second this year. (via)
humanely dealing with humungus crawlers.
Boombox City. Linked for the design styles; ignore the text. (via)
Magical Systems Thinking. 20 years ago this was called “skunkworks”. (also via)
SDF Plan 9 Boot Camp Registration. (via)

Your unrelated video link of the week: new Cyriak video. (via)

Get your own pf lesson

Justin Sherrill — Fri, 09 May 2025 16:20:37 +0000

Peter N. M. Hansteen runs a pf tutorial most years at BSDCan, and this year’s BSDCan is no different. He’s prepping now, so if you ask a good question, you’ll get taught the answer.

IPv6 and NAT fix

Justin Sherrill — Fri, 27 May 2022 13:43:41 +0000

If you are trying to use both NAT and IPv6 with pf on DragonFly, there was a bug (seen here with FreeBSD) with :0 where it would use link-local addresses. It’s now fixed.

Behavior change for skip in pf

Justin Sherrill — Wed, 25 May 2022 15:41:27 +0000

If you are using ‘set skip on …’ in your pf config, it used to match any interface that matched the specified type. It now only matches members of that named group. That may change behavior of your pf rules; check the commit to see what to look for.

In Other BSDs for 2020/02/06

Justin Sherrill — Sat, 06 Feb 2021 13:56:24 +0000

Hardware-heavy this week, sorta.

leave(1) – remind you when you have to leave.
Valuable News – 2021/02/01.
Calibrate your touch-screen on OpenBSD.
Annotate your PDF files on OpenBSD.
BREAKING pf(4) change: change route-to so it sends packets to IPs instead of interfaces.
TwinCAT/BSD, a new (to me at least) commercial use of FreeBSD in industrial settings.
WireGuard for pfSense Software. I like that it’s sponsored work everyone gets access to.
ujoy(4) added to -current. (OpenBSD)
FreeBSD Bhyve Overview – Why Its Better Than Other Hypervisors. (via)
Gamecontroller updates in -current. Related to previous link.
OpenBSD KDE Status Report.
Follow-up about FreeBSD jail advantages.
AAA Gaming on OpenBSD with Google Stadia.
FreeBSD Remote Process Plugin on Non-x86 Architectures.
MirBSD “announce” RSS feed. A good idea for any project.
find mostly doesn’t need xargs today on modern Unixes.

pf table size check and change

Justin Sherrill — Mon, 29 Jun 2020 17:46:12 +0000

Did you know there’s a default size limit to pf’s routing table? I did not, but it makes sense that there is one. If for some reason you bump into this limit (difficult for home use, I’d think), here’s how you change it.

In Other BSDs for 2019/04/06

Justin Sherrill — Sat, 06 Apr 2019 12:54:58 +0000

Lots of BUG news this week; thank you all for the leads on groups to watch.

Talking Jails at Semibug, 9 April 2019. Note the meeting has been moved up a week.
“FreeBSD Mastery: Jails” and a new novella.
April 9th Meetup. ChiBUG.
Rusted ravens: Ravenports march 2019 status update. There’s some DragonFly stuff in there I haven’t had a chance to link to.
How to use NetBSD on a Raspberry Pi. (via)
Serenity: x86 Unix-like operating system for IBM PC-compatibles. Almost UNIX, almost BSD. (via)
Before Unix: An Early History of Timesharing Systems. Influences on BSD.(via)
OpenRA imported – game engine recreation for RTS games of the Command & Conquer family. (via)
Project Trident 18.12-U8 Available. (via)
Removing PF. (via)
Silent Fanless FreeBSD Server – Redundant Backup. (via)
LLDB/LLVM report for March 2019. NetBSD.
Continuation of signal semantics improvements. NetBSD.
iked curve25519 group number change. OpenBSD.
Valuable News – 2019/04/01.
Sega Dreamcast Running NetBSD. (via)
UNIX and BSD Discord/Matrix Servers.
BSD Router Project 1.92 is now available. (via)

In Other BSDs for 2018/11/24

Justin Sherrill — Sat, 24 Nov 2018 14:00:35 +0000

Games are the unofficial accidental theme this week.

FreeBSD 12 Release Engineering Branch Created. Also, RC1 (via)
Distrowatch.com NetBSD 8.0 Review. (via)
Celebrating 50 years of Unix. (via)
FreeBSD Network Management with network.sh. (via)
FreeBSD Desktop – Part 2.1 – Install FreeBSD 12.
Our pragmatic attachment to OpenBSD PF for our firewall needs.
Linux iptables compared to OpenBSD PF (through a real example).
Bump.
(OpenBSD) /etc/malloc.conf replaced by sysctl.
(OpenBSD) ifconfig(8): vlandev and vlan upcoming option removal along with vlan(4): Replace link0 flag with txprio.
Let’s Try on OpenBSD – Dust: An Elysian Tail and Let’s Try on OpenBSD: Capsized.
GOG Black Friday Sale. A nice connection between sale and port.
Games on FreeBSD. A port of fnaify to other BSDs!
More OpenBSD contributions.
Valuable News – 2018/11/17.

In Other BSDs for 2018/06/30

Justin Sherrill — Sat, 30 Jun 2018 12:58:08 +0000

Some of this is overflow from last week.

m:tier subscription service for long-term OpenBSD updates. This is a good idea, connecting a service to the people that want to pay for it – without interfering with the “normal” free usage.
FreeBSD has lower latency, and Linux has faster application speeds. The comments at the link source may be better.
A Beginner’s Guide to Firewalling with pf. (via)
pfSense in VMware Workstation. (via)
“Would anyone be interested of this tool supported BSD?“
Using UNIX as IDE. (via)
FreeBSD 11.2 released.
HardenedBSD: Feature comparison vs other BSD distros. (via)
Booting OpenBSD kernels in EFI mode with QEMU. (via)
Call for testers – Audio improvements for NetBSD 8.1. (via)
WiFi Refresh. (via)
Rewards of Up to $500K Offered for FreeBSD, OpenBSD, NetBSD, Linux Zero-Days. (via)
FreeBSD Desktop – Part 11 – Key Components – Blue Light Spectrum Suppress. I didn’t know about Redshift; I like it.
Michael W. Lucas has a Patreon account, and a video to go with it. I’ve wondered if I should do something like that for the Digest.

Restarting pf

Justin Sherrill — Tue, 13 Sep 2016 18:40:04 +0000

I may have mentioned this in part before, but Matthew Dillon has a brief script to reload pf when an interface IP changes. I’m linking it here in case it’s useful in the future.

In Other BSDs for 2015/05/23

Justin Sherrill — Sat, 23 May 2015 12:57:34 +0000

A calmer week, probably because of the U.S. holiday.

FreeBSD Mastery: ZFS is out (eBook format).
DiscoverBSD for 2015/05/18.
PC-BSD 10.1.2 is out. (Update: hotfix)
freebsd-wifi-build (via)
bhyve on Pluribus, a platform I’m unfamiliar with. (via)
pkgSrcCon is happening July 4-5 in Berlin.
I like cross-pollination.
Diagnosing softraid failures on OpenBSD.
OpenBSD now has ntpd on by default.
OpenSMTPD vs. Logjam.
spamd/pf rule changes.
Various OpenBSD remote update methods.
FreeNAS status report.
iXSystems is gaining a dev blog.

BSDNow 072: Common *Sense Approach

Justin Sherrill — Fri, 16 Jan 2015 04:07:53 +0000

As promised last week, the BSDNow show has an interview with Jos Schellevis of OPNSense, along with the normal array of stories and links.

BSDNow 071: System Disaster

Justin Sherrill — Mon, 12 Jan 2015 23:52:09 +0000

I managed to miss this last week because of issues with my RSS feeds, but the 71st episode of BSDNow is/has been up. It’s “systemd isaster”, cause the interview is with Ian Sutton talking about BSD replacements for systemd dependencies. There’s a number of at-least-slightly DragonFly-related things in there, including OPNSense, pkgng, and Hammer mentions.

In Other BSDs for 2015/01/03

Justin Sherrill — Sat, 03 Jan 2015 14:44:45 +0000

Remembered to do this all at the last minute, after I got the new server up.

LibertyBSD, an OpenBSD fork with no non-free firmware.
OPNSense, a FreeBSD-based firewall that is new to me.
OpenBSD projects that aren’t OpenBSD.
Broken build tracker for pkgsrc. (via)
pkgsrc-2014Q4 is out.
pkgviews is gone from pkgsrc.
NetBSD can now record MIDI files from /dev/music.
How to see hidden pf tables.
The OpenBSD Foundation met their fundraising goal for 2014.
Typing in Japanese in OpenBSD. (via)
Tor relay issues on OpenBSD, in two slightly munged threads.
OpenBSD and syslog, over TCP.
FreeBSD has updated to Unbound 1.5.1 and clang/llvm/lldb to 3.5.0.
bhyve on FreeBSD has an improved Real Time Clock.
GNU texinfo is out of FreeBSD.
FreeBSD’s asr(4) driver is gone too.
pcc 1.1.0 was recently released. (via)

Book Review: The Book of PF, 3rd edition

Justin Sherrill — Mon, 29 Dec 2014 14:39:53 +0000

I’m going to dive right in with an anecdote: As is normal for anyone in systems administration, I’m busy at work. I’ve been short an employee for some time, and I brought in a managed service provider to do some work. This included a revamping of the network equipment and layout, as it has been growing organically rather than in a planned fashion.

I received the formal assessment from the provider a few weeks ago, and it mentioned that we were using a non ICSA-certified firewall: pf, in the form of pfSense. This was accompanied by some rather drastic warnings about how open source was targeted by hackers! and implied that ICSA certification was a mark of quality rather than a purchasable certification. All bogus, of course.

The reason I’m starting this review with this little story is to note that while open source has become well-accepted for system and application software, there’s still a lot of people that expect commercial hardware to be exclusively handling data once it leaves the server. That’s been valid for a long time, but software like pf represents a realistic option, or even an improvement, over many commercial and proprietary options. Since pf exists in one form or another on all the BSDs, it’s a tool you should be at least somewhat familiar with.

Peter N. M. Hansteen has written about pf first online, and then in printed form, for some time. The Book of PF is in its third edition, and that’s what I have to read. (Disclosure: No Starch Press gave me the book free, without requirements)

The book is excellent, and easier to read than I expected for a book about network processing. It can be read in linear form, as it takes the reader from simple to more complex network layouts. It works as a reference book, too, as it focuses on different tools around pf and what they are used for.

It covers the different pf version in OpenBSD, NetBSD, and FreeBSD, and DragonFly gets at least a partial mention in some portions of the book. For example, OpenBSD recently removed ALTQ, but the other BSDs still use it. With- and without-ALTQ scenarios are covered every place it applies. You’re going to get the most mileage out of an OpenBSD setup with it, though.

The parts where the book shines are the later chapters; the descriptions of greylisting and spamd, the traffic shaping notes, and the information on monitoring pf will be useful for most anyone. It’s quite readable; similar in tone to Peter’s blog. If you enjoy his in–depth online articles, the book will be a pleasant read.

It’s available now from Amazon and directly from No Starch Press. It’s linked in the book slider currently running on the right side of this site, too.

BSDNow 063: A man’s man(1)

Justin Sherrill — Fri, 14 Nov 2014 03:18:00 +0000

BSDNow 063 has the normal news articles and links, and an interview of Kristaps Džonsons, one of the people working on mandoc. There’s also a tutorial on bandwidth throttling with pf.

In Other BSDs for 2014/11/01

Justin Sherrill — Sat, 01 Nov 2014 13:26:25 +0000

Hardly any source commits to point at this week, but there’s still lots of stuff happening in BSD-land.

MeetBSD is happening right now.
OpenBSD 5.6 is being released right now too.
Michael W. Lucas has released the cover to his upcoming FreeBSD Mastery: Storage Essentials book.
Peter N. M. Hansteen’s 3rd edition of the Book of PF is out, and he’s running an auction for the first author-signed copy – with profits to OpenBSD. This is a good strategy. I have a copy of the book and will write a review here as soon as I can finish it – only up to chapter 3 right now. The presentation that spawned the book is updated and available.
FreeBSD 10.0 got an extension.
Don’t run wsmoused and X at the same time in OpenBSD.
NetBSD now has openresolv 3.6.1. It’s a resolv.conf management program I had not yet heard of.
FreeBSD has significant changes to /dev/random,
FreeBSD has gained TTM support in its AGP driver, and radeonkms in FreeBSD now supports AGP.
NYCBUG, upcoming.
DiscoverBSD for 2014/10/27.
The Apple Mac Takes Its Place In The Post-PC World. Unix-based computers are the best game in town, it appears. (via)
Lumina Desktop Build in FreeBSD / TrueOS. (video)

BSDNow 035: Puffy Firewall

Justin Sherrill — Fri, 02 May 2014 01:44:18 +0000

BSDNow 035 is up with a whole lot of pf content, including an interview of Peter Hansteen, of “Book of PF” fame. There’s a 3rd version of that book coming out soon.

In Other BSDs for 2014/04/26

Justin Sherrill — Sat, 26 Apr 2014 13:15:10 +0000

Another active week.

RetroBSD recently moved to Git and GitHub, and is now buildable on Mac OS X.
ALTQ is gone, at least for the OpenBSD version of pf.
So I’ll bring up this point again: pf is fragmenting, and we should do something about it.
The EdgeBSD presentation from FOSDEM 2014. (via)
OpenBSD could use some VLAN testing.
FreeBSDNews is running an swag contest.
netbsd.fi replaces onetbsd.org.
Here’s a GSoC project that could help everyone. (thanks, Tomáš Bodžár)
I’ve linked to some parts of this work, but Undeadly has a summary of the man page search improvements in OpenBSD.
DiscoverBSD’s 2014/04/14 summary.
LibreSSL started because of a leaky water heater.
I always like threads about small hardware.
FreeNAS hardware unboxing.
Man, everybody likes pfSense.
Lua in pkgsrc is getting versioned.
Why would you do this?

In Other BSDs for 2014/01/25

Justin Sherrill — Sat, 25 Jan 2014 14:40:06 +0000

Back to relatively normal volume, this week.

FreeBSD 10 is out.
OpenBSD got electrical funding, and is now holding a funding drive.
new openssh key format and bcrypt pbkdf. A new key format for OpenSSH, and how to switch to it – only available in OpenBSD as of this writing.
I did not know this: There’s a pfSense store, with shirts, preloaded USB sticks, and various appliances – I have one of the Netgate FW-7541 models, notable in that I’ve never had to do anything with it after initial setup; it just runs and runs. There’s a pfSense hangout/webcast for paid support customers this Friday the 24th, too.
Open Source FreeBSD 10 Takes on Virtualization. From a saved Google search.
Undeadly has an explanation of the new signed packages setup for OpenBSD.
DiscoverBSD’s 2014/01/14 roundup.
FreeBSD now has OpenSSL 1.0.1f.
NetBSD now has a wscons/Intel GMA driver.
PC-BSD 10 is almost out, and here’s their weekly digest talking about it. Also, apparently PC-BSd and GhostBSD share some installer code? I’m not clear on this.
CBSD – FreeBSD jail management. (via)
Slides and audio from Brian Callahan’s recent OpenBSD presentation at NYCBUG are up.
OpenBSD has a qla(4) driver, for Qlogic fiber channel HBAs, and ubcmtp(4), a Macbook touchpad driver.