PF vs IPFW vs NPF vs IPTABLES

Voyager

Who prefers which and why?

If I would have to make an order from favorite to least liked I would say:

1, IPTABLES
2, OpenBSD PF
3, IPFW
4, NPF

I started this discussion because I simply hated NPF for it's weird syntax that a FW ruleset looks like an object oriented program especially when you compare it with traditional fw rules like Cisco ACLs. So I had this one server I have configured with NPF for some basic tasks like 2 years ago and never touched it since, it was always on the bottom of my TODO list to implement some rules what needed (like pull blocklists from some providers and automatically add them once a week to a ruleset). Surprisingly I got to like it and I was even surprised how quick I got all my modifications I planned done.

For me IPTABLES is just the king of kings mostly because I using it since almost it exist and before that I was using ipchains so I got used to it. It has tons of modules and functionalities and this is the FW I have the most experience with I have setup countless of simple and very compled (over 1k rules) fw setups for servers, workstations, gateways with it.

Like until the point you just need some regular fw for a base machine to allow some services inbound and all stateful outbound it does not make a difference I would say FreeBSD with IPFW shines there, all you need is add this to your RC.CONF and your done:


# Simple firewall
firewall_enable="YES"
firewall_quiet="YES"
firewall_type="workstation"
firewall_myservices="6666 6667 6668 6112 6113"
firewall_allowservices="any"
firewall_logdeny="YES"
pflog_enable="YES"

However doing something more complex when you have multiple L2 VPNs bridged into a server where you have to direct traffic using physdev to different chains depending on which tap interface of the bridge port does it come in and you have to do ratelimiting, snat, dnat, logging, filtering out some stuff like dhcp traffic with ebtables underneath and marking packets for the traffic shaping I lose confidence in using other firewalls than iptables.

Moving over to OpenBSD's PF I just love it's syntax and simplicity and what I love about in OpenBSD a lot that they don't try to change things around every year or so. If I invest couple of days to write a decently large pf.conf I'm not worrying that it will not work in OpenBSD 7.0 anymore.

JuvenalUrbino

Voyager Like until the point you just need some regular fw for a base machine to allow some services inbound and all stateful outbound it does not make a difference I would say FreeBSD with IPFW shines there, all you need is add this to your RC.CONF and your done:

Voyager firewall_type="workstation"

Enabling a preformed configuration doesn't substantially differ from importing samples provided with the base system on other BSDs too.
I used IPFW for years, and I find its syntax similar to that of PF and NPF, but in my experience it tends to turn out slightly more redundant, as it doesn't provide the same level of abstraction as the aforementioned two.

Voyager For me IPTABLES is just the king of kings

I do not doubt it works well for you, as it did and does for many others, but I suspect that's because you grew accustomed to it over the years and learned to manage it proficiently, so that now it's become your cup of tea. As far as I can tell, hanging around *nix fora, it is a common belief that IPTABLES configuration is all but straightforward, if anything, rather complex and counter-intuitive. The man page would be enough to put down any newcomer, and that's why stuff like firewalld and ufw exists. Red Hat using firewalld on RHEL/Fedora/CentOS tells a lot about it. The relevant netfilter kernel configuration is hard to grasp at first sight and I found myself having to rebuild the kernel more than once on Gentoo in order to get it working properly.

Voyager Moving over to OpenBSD's PF I just love it's syntax and simplicity

Again, and even more so, in which way does PF's syntax differ so dramatically from that of NPF?

Anyway, my choice now falls onto PF or NPF on BSD, IPF on Illumos (I remember seeing many IPF users on FreeBSD forums, even in the last few years, mainly people who had moved from Solaris after Oracle's acquisition. In the end, it just works and it's really well documented). NPF was one of the things which drew my attention over NetBSD, so I'm kind of biased towards it as I've become more used to it than the others (just like iptables in your case)

numbercruncher

Voyager You are wrong about Linux, iptables is not its firewall! Iptables is just the userland tool being used to configure the firewall system in the Linux kernel, and in that case its name is Netfilter.
Furthermore you should be aware of that the Linux kernel has since 2014 another firewall component called nftables builtin, which is supposed to replace Netfilter some day altogether.

netneo

Interesting. This is one area that I want to explore more in-depth. My experience with firewalls has mostly been limited to the local network. On Devuan, for the time being at least, I tend to just use ufw which relies on iptables. It's simple to manage and suits my needs which are mostly just about dealing with dedicated SSH ports and the likes anyway so nothing too complex. I've also used firewalld in the past.

On the other hand, I got into pf while testing FreeBSD some time ago. I tried to replicate the same setup I have on Devuan using pf and came to like the syntax and management tools. The learning curve is higher but it's pretty doable. It's nice to have the settings in a dedicated configuration file. I've moved to OpenBSD on one of my systems since so this is something that's high on my "todo" list.

kr0m

I have used iptables for years under Linux and IPFW for two years under FreeBSD, i am very familiarized with iptables but i prefer IPFW syntax, its clear and more intuitive for me.

I readed about PF but i think that there are diferent syntax betweem OpenBSD and FreeBSD version, so i decided to use IPFW.

I continue using Linux/iptables at work but for my new projects i prefer to use FreeBSD/IPFW instead, firstly for the stability of a FreeBSD system and secondly for the intuitive syntax.

joany

Between PF on OpenBSD and NPF which has the most users that are blogging and writing about their uses and experience's? I consider myself somewhat a beginner on the "filter" side. I found NPF (and you people here) the most friendly one.

JuvenalUrbino

joany Between PF on OpenBSD and NPF which has the most users that are blogging and writing about their uses and experience's? I

PF by orders of magnitudes. Not only PF has a much longer history, but, in its many divergent implementations, it represents the default firewall on a series of noteworthy Unices (OpenBSD, FreeBSD, Solaris, macOS and QNX).

sukamu

In all my experience of sysadmin, which is not precisely a short time, i've found myself struggling less with PF than with any Firewall for Linux. So my favorite firewall is pf because it's easy to configure, just work, and has enough options for me. I really like how you can redirect ports from your machine to another machine, this way I can give VMs a very good use.