1.\" $OpenBSD: pfctl.8,v 1.138 2008/06/10 20:55:02 mcbride Exp $ 2.\" 3.\" Copyright (c) 2001 Kjell Wooding. All rights reserved. 4.\" 5.\" Redistribution and use in source and binary forms, with or without 6.\" modification, are permitted provided that the following conditions 7.\" are met: 8.\" 1. Redistributions of source code must retain the above copyright 9.\" notice, this list of conditions and the following disclaimer. 10.\" 2. Redistributions in binary form must reproduce the above copyright 11.\" notice, this list of conditions and the following disclaimer in the 12.\" documentation and/or other materials provided with the distribution. 13.\" 3. The name of the author may not be used to endorse or promote products 14.\" derived from this software without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 21.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 22.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 25.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26.\" 27.Dd August 5, 2025 28.Dt PFCTL 8 29.Os 30.Sh NAME 31.Nm pfctl 32.Nd control the packet filter (PF) device 33.Sh SYNOPSIS 34.Nm pfctl 35.Bk -words 36.Op Fl AdeghMmNnOPqRrvz 37.Op Fl a Ar anchor 38.Oo Fl D Ar macro Ns = 39.Ar value Oc 40.Op Fl F Ar modifier 41.Op Fl f Ar file 42.Op Fl i Ar interface 43.Op Fl K Ar host | network 44.Xo 45.Oo Fl k 46.Ar host | network | label | id | gateway | nat 47.Oc Xc 48.Op Fl o Ar level 49.Op Fl p Ar device 50.Op Fl s Ar modifier 51.Xo 52.Oo Fl t Ar table 53.Fl T Ar command 54.Op Ar address ... 55.Oc Xc 56.Op Fl x Ar level 57.Ek 58.Sh DESCRIPTION 59The 60.Nm 61utility communicates with the packet filter device using the 62ioctl interface described in 63.Xr pf 4 . 64It allows ruleset and parameter configuration and retrieval of status 65information from the packet filter. 66.Pp 67Packet filtering restricts the types of packets that pass through 68network interfaces entering or leaving the host based on filter 69rules as described in 70.Xr pf.conf 5 . 71The packet filter can also replace addresses and ports of packets. 72Replacing source addresses and ports of outgoing packets is called 73NAT (Network Address Translation) and is used to connect an internal 74network (usually reserved address space) to an external one (the 75Internet) by making all connections to external hosts appear to 76come from the gateway. 77Replacing destination addresses and ports of incoming packets 78is used to redirect connections to different hosts and/or ports. 79A combination of both translations, bidirectional NAT, is also 80supported. 81Translation rules are described in 82.Xr pf.conf 5 . 83.Pp 84When the variable 85.Va pf_enable 86is set to 87.Dv YES 88in 89.Xr rc.conf 5 , 90the rule file specified with the variable 91.Va pf_rules 92is loaded automatically by the 93.Xr rc 8 94scripts and the packet filter is enabled. 95.Pp 96The packet filter does not itself forward packets between interfaces. 97Forwarding can be enabled by setting the 98.Xr sysctl 8 99variables 100.Em net.inet.ip.forwarding 101and/or 102.Em net.inet6.ip6.forwarding 103to 1. 104Set them permanently in 105.Xr sysctl.conf 5 . 106.Pp 107At least one option must be specified. 108The options are as follows: 109.Bl -tag -width Ds 110.It Fl A 111Load only the queue rules present in the rule file. 112Other rules and options are ignored. 113.It Fl a Ar anchor 114Apply flags 115.Fl f , 116.Fl F , 117.Fl s , 118and 119.Fl T 120only to the rules in the specified 121.Ar anchor . 122In addition to the main ruleset, 123.Nm 124can load and manipulate additional rulesets by name, 125called anchors. 126The main ruleset is the default anchor. 127.Pp 128Anchors are referenced by name and may be nested, 129with the various components of the anchor path separated by 130.Sq / 131characters, similar to how file system hierarchies are laid out. 132The last component of the anchor path is where ruleset operations are 133performed. 134.Pp 135Evaluation of 136.Ar anchor 137rules from the main ruleset is described in 138.Xr pf.conf 5 . 139.Pp 140For example, the following will show all filter rules (see the 141.Fl s 142flag below) inside the anchor 143.Dq authpf/smith(1234) , 144which would have been created for user 145.Dq smith 146by 147.Xr authpf 8 , 148PID 1234: 149.Bd -literal -offset indent 150# pfctl -a "authpf/smith(1234)" -s rules 151.Ed 152.Pp 153Private tables can also be put inside anchors, either by having table 154statements in the 155.Xr pf.conf 5 156file that is loaded in the anchor, or by using regular table commands, as in: 157.Bd -literal -offset indent 158# pfctl -a foo/bar -t mytable -T add 1.2.3.4 5.6.7.8 159.Ed 160.Pp 161When a rule referring to a table is loaded in an anchor, the rule will use the 162private table if one is defined, and then fall back to the table defined in the 163main ruleset, if there is one. 164This is similar to C rules for variable scope. 165It is possible to create distinct tables with the same name in the global 166ruleset and in an anchor, but this is often bad design and a warning will be 167issued in that case. 168.Pp 169By default, recursive inline printing of anchors applies only to unnamed 170anchors specified inline in the ruleset. 171If the anchor name is terminated with a 172.Sq * 173character, the 174.Fl s 175flag will recursively print all anchors in a brace delimited block. 176For example the following will print the 177.Dq authpf 178ruleset recursively: 179.Bd -literal -offset indent 180# pfctl -a 'authpf/*' -sr 181.Ed 182.Pp 183To print the main ruleset recursively, specify only 184.Sq * 185as the anchor name: 186.Bd -literal -offset indent 187# pfctl -a '*' -sr 188.Ed 189.Pp 190To flush all rulesets and tables recursively, specify only 191.Sq * 192as the anchor name: 193.Bd -literal -offset indent 194# pfctl -a '*' -Fa 195.Ed 196.It Fl D Ar macro Ns = Ns Ar value 197Define 198.Ar macro 199to be set to 200.Ar value 201on the command line. 202Overrides the definition of 203.Ar macro 204in the ruleset. 205.It Fl d 206Disable the packet filter. 207.It Fl e 208Enable the packet filter. 209.It Fl F Ar modifier 210Flush the filter parameters specified by 211.Ar modifier 212(may be abbreviated): 213.Pp 214.Bl -tag -width xxxxxxxxxxxx -compact 215.It Fl F Cm nat 216Flush the NAT rules. 217.It Fl F Cm queue 218Flush the queue rules. 219.It Fl F Cm ethernet 220Flush the Ethernet filter rules. 221.It Fl F Cm rules 222Flush the filter rules. 223.It Fl F Cm states 224Flush the state table (NAT and filter). 225.It Fl F Cm Sources 226Flush the source tracking table. 227.It Fl F Cm info 228Flush the filter information (statistics that are not bound to rules). 229.It Fl F Cm Tables 230Flush the tables. 231.It Fl F Cm osfp 232Flush the passive operating system fingerprints. 233.It Fl F Cm Reset 234Reset limits, timeouts and other options back to default settings. 235See the OPTIONS section in 236.Xr pf.conf 5 237for details. 238.It Fl F Cm all 239Flush all of the above. 240.El 241.Pp 242If 243.Fl a 244is specified as well and 245.Ar anchor 246is terminated with a 247.Sq * 248character, 249.Cm rules , 250.Cm Tables 251and 252.Cm all 253flush the given anchor recursively. 254.It Fl f Ar file 255Load the rules contained in 256.Ar file . 257This 258.Ar file 259may contain macros, tables, options, and normalization, queueing, 260translation, and filtering rules. 261With the exception of macros and tables, the statements must appear in that 262order. 263.It Fl g 264Include output helpful for debugging. 265.It Fl h 266Help. 267.It Fl i Ar interface 268Restrict the operation to the given 269.Ar interface . 270.It Fl K Ar host | network 271Kill all of the source tracking entries originating from the specified 272.Ar host 273or 274.Ar network . 275A second 276.Fl K Ar host 277or 278.Fl K Ar network 279option may be specified, which will kill all the source tracking 280entries from the first host/network to the second. 281.It Xo 282.Fl k 283.Ar host | network | label | id | key | gateway | nat 284.Xc 285Kill all of the state entries matching the specified 286.Ar host , 287.Ar network , 288.Ar label , 289.Ar id , 290.Ar key , 291.Ar gateway, 292or 293.Ar nat. 294.Pp 295For example, to kill all of the state entries originating from 296.Dq host : 297.Pp 298.Dl # pfctl -k host 299.Pp 300A second 301.Fl k Ar host 302or 303.Fl k Ar network 304option may be specified, which will kill all the state entries 305from the first host/network to the second. 306To kill all of the state entries from 307.Dq host1 308to 309.Dq host2 : 310.Pp 311.Dl # pfctl -k host1 -k host2 312.Pp 313To kill all states originating from 192.168.1.0/24 to 172.16.0.0/16: 314.Pp 315.Dl # pfctl -k 192.168.1.0/24 -k 172.16.0.0/16 316.Pp 317A network prefix length of 0 can be used as a wildcard. 318To kill all states with the target 319.Dq host2 : 320.Pp 321.Dl # pfctl -k 0.0.0.0/0 -k host2 322.Pp 323It is also possible to kill states by rule label, state key or state ID. 324In this mode the first 325.Fl k 326argument is used to specify the type 327of the second argument. 328The following command would kill all states that have been created 329from rules carrying the label 330.Dq foobar : 331.Pp 332.Dl # pfctl -k label -k foobar 333.Pp 334To kill one specific state by its key 335(protocol, host1, port1, direction, host2 and port2 in the same format 336of pfctl -s state), 337use the 338.Ar key 339modifier and as a second argument the state key. 340To kill a state whose protocol is TCP and originating from 34110.0.0.101:32123 to 10.0.0.1:80 use: 342.Pp 343.Dl # pfctl -k key -k 'tcp 10.0.0.1:80 <- 10.0.0.101:32123' 344.Pp 345To kill one specific state by its unique state ID 346(as shown by pfctl -s state -vv), 347use the 348.Ar id 349modifier and as a second argument the state ID and optional creator ID. 350To kill a state with ID 4823e84500000003 use: 351.Pp 352.Dl # pfctl -k id -k 4823e84500000003 353.Pp 354To kill a state with ID 4823e84500000018 created from a backup 355firewall with hostid 00000002 use: 356.Pp 357.Dl # pfctl -k id -k 4823e84500000018/2 358.Pp 359It is also possible to kill states created from a rule with the route-to/reply-to 360parameter set to route the connection through a particular gateway. 361Note that rules routing via the default routing table (not via a route-to 362rule) will have their rt_addr set as 0.0.0.0 or ::. 363To kill all states using a gateway of 192.168.0.1 use: 364.Pp 365.Dl # pfctl -k gateway -k 192.168.0.1 366.Pp 367A network prefix length can also be specified. 368To kill all states using a gateway in 192.168.0.0/24: 369.Pp 370.Dl # pfctl -k gateway -k 192.168.0.0/24 371.Pp 372States can also be killed based on their pre-NAT address: 373.Pp 374.Dl # pfctl -k nat -k 192.168.0.1 375.Pp 376.It Fl M 377Kill matching states in the opposite direction (on other interfaces) when 378killing states. 379This applies to states killed using the -k option and also will apply to the 380flush command when flushing states. 381This is useful when an interface is specified when flushing states. 382Example: 383.Pp 384.Dl # pfctl -M -i interface -Fs 385.Pp 386.It Fl m 387Merge in explicitly given options without resetting those 388which are omitted. 389Allows single options to be modified without disturbing the others: 390.Bd -literal -offset indent 391# echo "set loginterface fxp0" | pfctl -mf - 392.Ed 393.It Fl N 394Load only the NAT rules present in the rule file. 395Other rules and options are ignored. 396.It Fl n 397Do not actually load rules, just parse them. 398.It Fl O 399Load only the options present in the rule file. 400Other rules and options are ignored. 401.It Fl o Ar level 402Control the ruleset optimizer, overriding any rule file settings. 403.Pp 404.Bl -tag -width xxxxxxxxxxxx -compact 405.It Fl o Cm none 406Disable the ruleset optimizer. 407.It Fl o Cm basic 408Enable basic ruleset optimizations. 409This is the default behaviour. 410.It Fl o Cm profile 411Enable basic ruleset optimizations with profiling. 412.El 413.Pp 414For further information on the ruleset optimizer, see 415.Xr pf.conf 5 . 416.It Fl P 417Do not perform service name lookup for port specific rules, 418instead display the ports numerically. 419.It Fl p Ar device 420Use the device file 421.Ar device 422instead of the default 423.Pa /dev/pf . 424.It Fl q 425Only print errors and warnings. 426.It Fl R 427Load only the filter rules present in the rule file. 428Other rules and options are ignored. 429.It Fl r 430Perform reverse DNS lookups on states and tables when displaying them. 431.Fl N 432and 433.Fl r 434are mutually exclusive. 435.It Fl s Ar modifier Op Fl R Ar id 436Show the filter parameters specified by 437.Ar modifier 438(may be abbreviated): 439.Pp 440.Bl -tag -width xxxxxxxxxxxxx -compact 441.It Fl s Cm nat 442Show the currently loaded NAT rules. 443.It Fl s Cm queue 444Show the currently loaded queue rules. 445When used together with 446.Fl v , 447per-queue statistics are also shown. 448When used together with 449.Fl v v , 450.Nm 451will loop and show updated queue statistics every five seconds, including 452measured bandwidth and packets per second. 453.It Fl s Cm ether 454Show the currently loaded Ethernet rules. 455When used together with 456.Fl v , 457the per-rule statistics (number of evaluations, 458packets, and bytes) are also shown. 459.It Fl s Cm rules 460Show the currently loaded filter rules. 461When used together with 462.Fl v , 463the per-rule statistics (number of evaluations, 464packets, and bytes) are also shown. 465Note that the 466.Dq skip step 467optimization done automatically by the kernel 468will skip evaluation of rules where possible. 469Packets passed statefully are counted in the rule that created the state 470(even though the rule is not evaluated more than once for the entire 471connection). 472.It Fl s Cm Anchors 473Show the currently loaded anchors directly attached to the main ruleset. 474If 475.Fl a Ar anchor 476is specified as well, the anchors loaded directly below the given 477.Ar anchor 478are shown instead. 479If 480.Fl v 481is specified, all anchors attached under the target anchor will be 482displayed recursively. 483.It Fl s Cm states 484Show the contents of the state table. 485.It Fl s Cm Sources 486Show the contents of the source tracking table. 487.It Fl s Cm info 488Show filter information (statistics and counters). 489When used together with 490.Fl v , 491source tracking statistics, the firewall's 32-bit hostid number and the 492main ruleset's MD5 checksum for use with 493.Xr pfsync 4 494are also shown. 495.It Fl s Cm Running 496Show the running status and provide a non-zero exit status when disabled. 497.It Fl s Cm labels 498Show per-rule statistics (label, evaluations, packets total, bytes total, 499packets in, bytes in, packets out, bytes out, state creations) of 500filter rules with labels, useful for accounting. 501.It Fl s Cm timeouts 502Show the current global timeouts. 503.It Fl s Cm memory 504Show the current pool memory hard limits. 505.It Fl s Cm Tables 506Show the list of tables. 507.It Fl s Cm osfp 508Show the list of operating system fingerprints. 509.It Fl s Cm Interfaces 510Show the list of interfaces and interface groups available to PF. 511When used together with 512.Fl v , 513it additionally lists which interfaces have skip rules activated. 514When used together with 515.Fl vv , 516interface statistics are also shown. 517.Fl i 518can be used to select an interface or a group of interfaces. 519.It Fl s Cm all 520Show all of the above, except for the lists of interfaces and operating 521system fingerprints. 522.El 523.Pp 524Counters shown with 525.Fl s Cm info 526are: 527.Pp 528.Bl -tag -width xxxxxxxxxxxxxx -compact 529.It match 530explicit rule match 531.It bad-offset 532currently unused 533.It fragment 534invalid fragments dropped 535.It short 536short packets dropped 537.It normalize 538dropped by normalizer: illegal packets 539.It memory 540memory could not be allocated 541.It bad-timestamp 542bad TCP timestamp; RFC 1323 543.It congestion 544network interface queue congested 545.It ip-option 546bad IP/IPv6 options 547.It proto-cksum 548invalid protocol checksum 549.It state-mismatch 550packet was associated with a state entry, but sequence numbers did not match 551.It state-insert 552state insertion failure 553.It state-limit 554configured state limit was reached 555.It src-limit 556source node/connection limit 557.It synproxy 558dropped by synproxy 559.It map-failed 560address mapping failed 561.It translate 562no free ports in translation port range 563.El 564.It Fl S 565Do not perform domain name resolution. 566If a name cannot be resolved without DNS, an error will be reported. 567.It Fl t Ar table Fl T Ar command Op Ar address ... 568Specify the 569.Ar command 570(may be abbreviated) to apply to 571.Ar table . 572Commands include: 573.Pp 574.Bl -tag -width "-T expire number" -compact 575.It Fl T Cm add 576Add one or more addresses to a table. 577Automatically create a persistent table if it does not exist. 578.It Fl T Cm delete 579Delete one or more addresses from a table. 580.It Fl T Cm expire Ar number 581Delete addresses which had their statistics cleared more than 582.Ar number 583seconds ago. 584For entries which have never had their statistics cleared, 585.Ar number 586refers to the time they were added to the table. 587.It Fl T Cm flush 588Flush all addresses in a table. 589.It Fl T Cm kill 590Kill a table. 591.It Fl T Cm replace 592Replace the addresses of the table. 593Automatically create a persistent table if it does not exist. 594.It Fl T Cm show 595Show the content (addresses) of a table. 596.It Fl T Cm test 597Test if the given addresses match a table. 598.It Fl T Cm zero Op Ar address ... 599Clear all the statistics of a table, or only for specified addresses. 600.It Fl T Cm reset 601Clear statistics only for addresses with non-zero statistics. Addresses 602with counter values at zero and their 603.Dq Cleared 604timestamp are left untouched. 605.It Fl T Cm load 606Load only the table definitions from 607.Xr pf.conf 5 . 608This is used in conjunction with the 609.Fl f 610flag, as in: 611.Bd -literal -offset indent 612# pfctl -Tl -f pf.conf 613.Ed 614.El 615.Pp 616For the 617.Cm add , 618.Cm delete , 619.Cm replace , 620and 621.Cm test 622commands, the list of addresses can be specified either directly on the command 623line and/or in an unformatted text file, using the 624.Fl f 625flag. 626Comments starting with a 627.Sq # 628or 629.Sq \; 630are allowed in the text file. 631With these commands, the 632.Fl v 633flag can also be used once or twice, in which case 634.Nm 635will print the 636detailed result of the operation for each individual address, prefixed by 637one of the following letters: 638.Pp 639.Bl -tag -width XXX -compact 640.It A 641The address/network has been added. 642.It C 643The address/network has been changed (negated). 644.It D 645The address/network has been deleted. 646.It M 647The address matches 648.Po 649.Cm test 650operation only 651.Pc . 652.It X 653The address/network is duplicated and therefore ignored. 654.It Y 655The address/network cannot be added/deleted due to conflicting 656.Sq \&! 657attributes. 658.It Z 659The address/network has been cleared (statistics). 660.El 661.Pp 662Each table can maintain a set of counters that can be retrieved using the 663.Fl v 664flag of 665.Nm . 666For example, the following commands define a wide open firewall which will keep 667track of packets going to or coming from the 668.Ox 669FTP server. 670The following commands configure the firewall and send 10 pings to the FTP 671server: 672.Bd -literal -offset indent 673# printf "table <test> counters { ftp.openbsd.org }\en \e 674 pass out to <test>\en" | pfctl -f- 675# ping -qc10 ftp.openbsd.org 676.Ed 677.Pp 678We can now use the table 679.Cm show 680command to output, for each address and packet direction, the number of packets 681and bytes that are being passed or blocked by rules referencing the table. 682The time at which the current accounting started is also shown with the 683.Dq Cleared 684line. 685.Bd -literal -offset indent 686# pfctl -t test -vTshow 687 129.128.5.191 688 Cleared: Thu Feb 13 18:55:18 2003 689 In/Block: [ Packets: 0 Bytes: 0 ] 690 In/Pass: [ Packets: 10 Bytes: 840 ] 691 Out/Block: [ Packets: 0 Bytes: 0 ] 692 Out/Pass: [ Packets: 10 Bytes: 840 ] 693.Ed 694.Pp 695Similarly, it is possible to view global information about the tables 696by using the 697.Fl v 698modifier twice and the 699.Fl s 700.Cm Tables 701command. 702This will display the number of addresses on each table, 703the number of rules which reference the table, and the global 704packet statistics for the whole table: 705.Bd -literal -offset indent 706# pfctl -vvsTables 707--a-r-C test 708 Addresses: 1 709 Cleared: Thu Feb 13 18:55:18 2003 710 References: [ Anchors: 0 Rules: 1 ] 711 Evaluations: [ NoMatch: 3496 Match: 1 ] 712 In/Block: [ Packets: 0 Bytes: 0 ] 713 In/Pass: [ Packets: 10 Bytes: 840 ] 714 In/XPass: [ Packets: 0 Bytes: 0 ] 715 Out/Block: [ Packets: 0 Bytes: 0 ] 716 Out/Pass: [ Packets: 10 Bytes: 840 ] 717 Out/XPass: [ Packets: 0 Bytes: 0 ] 718.Ed 719.Pp 720As we can see here, only one packet \- the initial ping request \- matched the 721table, but all packets passing as the result of the state are correctly 722accounted for. 723Reloading the table(s) or ruleset will not affect packet accounting in any way. 724The two 725.Dq XPass 726counters are incremented instead of the 727.Dq Pass 728counters when a 729.Dq stateful 730packet is passed but does not match the table anymore. 731This will happen in our example if someone flushes the table while the 732.Xr ping 8 733command is running. 734.Pp 735When used with a single 736.Fl v , 737.Nm 738will only display the first line containing the table flags and name. 739The flags are defined as follows: 740.Pp 741.Bl -tag -width XXX -compact 742.It c 743For constant tables, which cannot be altered outside 744.Xr pf.conf 5 . 745.It p 746For persistent tables, which do not get automatically killed when no rules 747refer to them. 748.It a 749For tables which are part of the 750.Em active 751tableset. 752Tables without this flag do not really exist, cannot contain addresses, and are 753only listed if the 754.Fl g 755flag is given. 756.It i 757For tables which are part of the 758.Em inactive 759tableset. 760This flag can only be witnessed briefly during the loading of 761.Xr pf.conf 5 . 762.It r 763For tables which are referenced (used) by rules. 764.It h 765This flag is set when a table in the main ruleset is hidden by one or more 766tables of the same name from anchors attached below it. 767.It C 768This flag is set when per-address counters are enabled on the table. 769.El 770.It Fl v 771Produce more verbose output. 772A second use of 773.Fl v 774will produce even more verbose output including ruleset warnings. 775See the previous section for its effect on table commands. 776.It Fl x Ar level 777Set the debug 778.Ar level 779(may be abbreviated) to one of the following: 780.Pp 781.Bl -tag -width xxxxxxxxxxxx -compact 782.It Fl x Cm none 783Do not generate debug messages. 784.It Fl x Cm urgent 785Generate debug messages only for serious errors. 786.It Fl x Cm misc 787Generate debug messages for various errors. 788.It Fl x Cm loud 789Generate debug messages for common conditions. 790.El 791.It Fl z 792Clear per-rule statistics. 793.El 794.Sh FILES 795.Bl -tag -width "/etc/pf.conf" -compact 796.It Pa /etc/pf.conf 797Packet filter rules file. 798.It Pa /etc/pf.os 799Passive operating system fingerprint database. 800.El 801.Sh SEE ALSO 802.Xr pf 4 , 803.Xr pf.conf 5 , 804.Xr pf.os 5 , 805.Xr rc.conf 5 , 806.Xr services 5 , 807.Xr sysctl.conf 5 , 808.Xr authpf 8 , 809.Xr ftp-proxy 8 , 810.Xr rc 8 , 811.Xr sysctl 8 812.Sh HISTORY 813The 814.Nm 815program and the 816.Xr pf 4 817filter mechanism appeared in 818.Ox 3.0 . 819They first appeared in 820.Fx 5.3 821ported from the version in 822.Ox 3.5 823