Firewall (PF)

{{#DRIFT_BADGE}}{{#B_UNSAVED}}Unsaved edits{{/B_UNSAVED}}{{#B_DRIFT}}{{B_LABEL}}{{/B_DRIFT}}{{#B_ERROR}}Drift state unknown{{/B_ERROR}}{{#B_OK}}In sync{{/B_OK}}{{/DRIFT_BADGE}}
{{#ERROR}}
{{ERROR}}
{{/ERROR}} {{#FLASH}}
{{FLASH}}
{{/FLASH}} {{#PF_UNADOPTED}}

Existing firewall detected

An existing /etc/pf.conf ruleset is present that OgmaProtect does not yet manage. Until you import it, the firewall shown here is empty and drift alarms may fire. Importing brings your existing rules under OgmaProtect management (your current /etc/pf.conf is saved to /var/db/ogmaprotect/config/pf.conf.preadopt first) and applies them with the usual auto-revert window so you can review and Keep or Revert.

A ruleset that uses anchors, includes or ! commands cannot be imported automatically — you will get a message to migrate it by hand (see the INSTALL guide).

{{#WRITE}}
{{#PF_LOCKOUT_REARM}}
Importing these rules would drop your management access. The declared management path (SSH/HTTPS to this box) is not preserved by the existing ruleset. If you have out-of-band recovery, tick the box to import anyway.
{{/PF_LOCKOUT_REARM}}
{{/WRITE}}
{{/PF_UNADOPTED}}
PF {{#PF_STATE_AGREE}} {{ENABLED_LABEL}} · live · at boot {{/PF_STATE_AGREE}} {{^PF_STATE_AGREE}} Configured {{ENABLED_LABEL}} Live PF {{LIVE_ENABLED_LABEL}} At boot {{RC_ENABLED_LABEL}} {{/PF_STATE_AGREE}}
{{#WRITE}} {{#NOT_PENDING}}
{{/NOT_PENDING}} {{/WRITE}}
{{#PENDING}}
Awaiting confirmation by {{PENDING_ACTOR}}{{^PENDING_REVERT_FAILED}} · reverts in {{PENDING_REMAINING}} s unless kept{{/PENDING_REVERT_FAILED}}
{{#WRITE}}
{{/WRITE}}
{{#PENDING_REVERT_FAILED}}
Automatic revert failed — manual recovery required. From the console: ogmaprotectctl pf cancel {{PENDING_TXN_ID}}
{{/PENDING_REVERT_FAILED}} {{/PENDING}}
{{#LEGACY_LOCKED}} {{#WRITE}}
{{/WRITE}} {{/LEGACY_LOCKED}} {{PF_MGMT_NOTICE}}
{{#CONVERT}}{{/CONVERT}} {{#PF_LOCKOUT_REARM}}
This ruleset would drop your management access. The firewall refused it because the declared management path (SSH/HTTPS to this box) is not preserved. Fix the rules or your management declaration on the Safety tab — or, if you have out-of-band recovery, tick the box below to apply it anyway. {{#WRITE}} {{/WRITE}}
{{/PF_LOCKOUT_REARM}}
{{#LEGACY_LOCKED}} raw pf.conf · read-only {{#WRITE}} {{/WRITE}} {{/LEGACY_LOCKED}} Last match wins · quick stops {{#WRITE}} {{/WRITE}}
{{#LEGACY_LOCKED}}

Converting discards the raw rules; the live firewall keeps running unchanged until you build and apply a new ruleset here.

{{/LEGACY_LOCKED}}
{{PF_FILTERS_HTML}}

Top-of-ruleset set options applied before any filter rule. Leave a value as default (or blank) to use PF's built-in default.

{{PF_OPTIONS_HTML}}

Reusable names. ext_if = "vio0" lets you write on $ext_if in rules. Tag each macro with a type so the rule builder can suggest it in the right field, and add several values to build a { list } such as web_ports = "{ 80, 443 }".

{{#WRITE}} {{/WRITE}}
{{PF_MACROS_HTML}}
{{PF_MACRO_DATALISTS}}

Named address lists referenced as <name> in rules. Pick a source — a manual list (prefix an address with ! to exclude it), a network interface's live addresses, or self. persist keeps the table loaded even when no rule references it; const makes it read-only; counters tracks per-address traffic.

{{#WRITE}} {{/WRITE}}
{{PF_TABLES_HTML}}
{{#FEED_DISCOVER}}

Threat feed premium

{{FD_TEXT}}

Threat feed: what it blocks, and exactly what would leave this box if you turned it on.

{{/FEED_DISCOVER}}

Egress traffic shaping (QoS). Define an HFSC queue hierarchy: a root queue carries an interface and a total bandwidth; child queues name a parent and share it. Each root interface needs exactly one default leaf. Add optional flows for fq-codel fair-queueing on a leaf. Attach traffic with Set queue on a rule (Rules tab). Queues shape egress only and can never drop a packet.

{{#WRITE}} {{/WRITE}}
{{PF_QUEUES_HTML}}
{{PF_SAFETY_HTML}}

Read-only view of the PF text that will be validated and applied.

{{#EDIT_ACTIONS}}
Saved
{{/EDIT_ACTIONS}} {{#PENDING}}
Locked · confirm window a change by {{PENDING_ACTOR}} awaits confirmation above
{{/PENDING}} {{^PENDING}} {{#LEGACY_LOCKED}}
Locked · raw pf.conf read-only until you convert this firewall (Rules tab)
{{/LEGACY_LOCKED}} {{/PENDING}}
Live packet log (pflog)
Open to stream pflog packets.
TimeActionIfaceRulePacket

Decoded from the binary /var/log/pflog via tcpdump -r. Enter a rule number to watch hits for one rule. This shows only packets matched by rules that carry the log keyword, and may be empty on a stock configuration. Requires pf:*:read + log:*:read.