KernelTrap offers an in depth look at the recent efforts to port OpenBSD’s stateful packet filter, pf, to other operating systems. The article includes interviews from Pyun YongHyeon who’s working on the FreeBSD port, pf creator Daniel Hartmeier, pf developer Henning Brauer and OpenBSD creator Theo de Raadt.
In addition to discussing recent porting efforts, the last half of the article focuses on all the new features in pf that will be available with the May 1’st release of OpenBSD 3.3.
How does pf compare with iptables?
I cannot stand IPTables. Coming from the BSD side of the house IPFilters is so much nicer. PF is very similar and beautiful as well.
Is pf any better than iptables? If yes, anybody porting it (whether the whole thing or as feature ports) to Linux? Iptables/netfilter team?
i doubt it. these are competitors (pf vs iptables), so i dont think the netfilter team would spend any effort porting pf. it makes their efforts redundant and useless.
pf has nicer syntax, iptables has better performance.
If you are building a router or firewall box for just a small network, use openbsd/pf. If high performance is an issue, stick with iptables.
>pf has nicer syntax, iptables has better performance.
i would say its not as cut-and-dried as that. some details and fancy graphs:
http://www.benzedrine.cx/pf-paper.html
> pf has nicer syntax, iptables has better performance.
As Jemma has pointed out, you should review that comparison. Also note that much development has gone on since that was published (5/2002).
Iptables’ main performance advantage was due to the lack of true stateful tracking. It uses “connection tracking”, which does not monitor the SID. This functionality is now available via the patch-o-matic, and a proper comparison of filtering with this feature is needed.
-J.
pf has nicer syntax, iptables has better performance.
If you are building a router or firewall box for just a small network, use openbsd/pf. If high performance is an issue, stick with iptables.
Opposite here, I find BSD’s IPF, IPFW and PF have the better performance, better control packets and etc than IPChain and IPTables do.