How To Set Up PF Firewall on FreeBSD to Protect a Web Server

by

To set up the PF firewall on a FreeBSD system, follow these steps:

  1. Install PF:
 
# pkg install pf
  1. Enable PF on boot:
 
# echo pf_enable="YES" >> /etc/rc.conf
  1. Configure firewall rules: Create a file named /etc/pf.conf and add the firewall rules. Here is an example configuration to protect a web server:
# Interfaces
ext_if="vtnet0"
int_if="lo0"

# Variables
web_srv="192.168.0.100"

# Default policies
block all
pass out all keep state

# Allow incoming ssh
pass in on $ext_if proto tcp from any to any port 22 keep state

# Allow incoming http and https
pass in on $ext_if proto tcp from any to $web_srv port {80, 443} keep state

# Block incoming all other traffic
block in all

  1. Load the firewall rules:
 
# pfctl -f /etc/pf.conf
  1. Enable PF firewall:
 
# pfctl -e

Now, the PF firewall should be protecting the web server from unwanted traffic. You can use the pfctl command to manage the firewall rules, such as reloading the rules, displaying status, and more.

Leave a Comment