Skip to content

Objects in rules

Firewall and NAT rules can name a network object instead of an address or port. Objects are created on the Network objects page, under Building blocks in the device menu.

Using an object in a rule

In the rule form, type the object's name in Source or Destination; the field suggests matching objects. A named service goes in Service object.

Changing the object later changes every rule that names it.

What objects become in pf.conf

Addresses and networks become tables:

table <lan_net> { 192.168.1.0/24 }

Ports become macros, because a pf table holds only addresses:

web_ports = "{ 80, 443 }"

A group is written as the union of its members, because pf tables cannot nest. Show pf.conf on Security policy shows the result.