Skip to content

Firewall rules

Open Security policy in the device menu, on the Firewall tab.

How a packet is matched

The last matching rule wins. pf reads the whole ruleset and keeps the last rule that matched; it does not stop at the first. A broad rule placed after a narrow one overrides it.

The exception is a quick rule, which decides the packet at once. System rules and quick rules are quick; the rules you write are not.

Put general rules first, exceptions after

This is the reverse of first-match firewalls. To make an exception to a broad rule, place the exception below it.

The default deny sits at the top of the ruleset, so anything you want to allow is a pass rule below it.

Creating a rule

Click + Add Rule and choose:

Choice What it does
Custom Rule Create a rule from scratch
From Template Use a pre-built device profile

Custom rule

The New Rule form has:

  • Action — pass or block
  • Direction — in or out
  • Interface — the interface it applies to, or any
  • Protocol
  • Source and Destination, each with a Port — an address, a network object, or any
  • Description
  • Section — an optional heading to group your rules under, e.g. IoT. It only affects how the list is displayed.
  • Service object — a named service from Network objects. It supplies the protocol and destination port; leave it on None — use the protocol and port above to use the fields instead.
  • Schedule — Always, or a schedule. A scheduled rule only exists while its window is open, so it must be a pass.
  • Next hop (policy routing) — send matching traffic to this address instead of using the routing table. Leave empty for normal routing.
  • Log — Log matching packets to pflog, visible in Logs

pf syntax under the form shows the line the rule will become. Click Create Rule.

From a template

From Template opens Apply Template:

  1. Template — Choose a device template...: IP Camera, POS / TPE, VoIP Phone, Web Server, SSH Jump Host, IoT Device or Network Printer.
  2. Device IP address — the address of the equipment.
  3. Interface — where it is connected.
  4. Check Rules that will be created:, then click Apply Template.

The rules appear in their own section, named after the template. To build a whole network (VLAN, DHCP, NAT and rules together), use Integrations instead.

Editing, ordering and removing

  • Edit — click the row. Edit Rule opens with the same fields.
  • Reorder — drag a row by its grip. Order matters; see above.
  • Switch off — use the row's switch. A disabled rule is not written to the device at all.
  • Duplicate rule — copies a rule (including a quick rule) as an editable rule of your own.
  • Delete — the remove button at the end of the row.
  • Several at once — tick rows to Enable, Disable or Delete them together.

Rules created by an integration or template cannot be edited or moved one by one. The section header has Edit and Unmanage; Unmanage keeps the rules and turns them into ordinary rules you can edit.

Applying

Click Apply Changes, check the device is still reachable, then Confirm before the countdown ends. Otherwise the device restores its previous configuration on its own. See Security policy.

Checking what the device runs

Show pf.conf renders the generated ruleset in evaluation order. When a rule does not behave as expected, read it there first.