Clear firewall policy. Native OpenBSD PF.
Name your network zones, connect them to interfaces and choose which connections may pass between them. MakePF turns that configuration into readable OpenBSD PF rules.
MakePF is for OpenBSD. Version 1.0.0 is free and open source and uses only the Python standard library.
Install from PyPI · Source code · Documentation
Policy in plain sight
Keep zones, policies and service exceptions in separate files. MakePF supports IPv4 and IPv6 filtering, IPv4 source NAT and IPv4 TCP/UDP port forwarding. Router services need explicit permission.
In the policy file:
# SOURCE DESTINATION FAMILY ACTION
loc net both ACCEPT
all all both DROP
This policy allows connections from loc to net over IPv4 and IPv6. Other zone pairs are denied. Define the zones and interfaces in the accompanying files. The configuration reference covers the full setup.
Install
MakePF requires Python 3.11 or later. For a personal command that can check and compile configurations, install with pipx:
pipx install makepf==1.0.0
makepf --version
On OpenBSD, install pipx with doas pkg_add py3-pipx first. To manage the router's firewall, follow the system installation guide. It installs a root-owned command and configures doas for reloads.
Check, then reload
After system installation and configuration:
makepf check
doas makepf reload
MakePF reads /etc/makepf by default. Check the configuration as your regular user. On OpenBSD, this also checks native PF syntax. Reload repeats validation, applies the rules and saves them for reboot while retaining existing connections.
The first reload of an existing unmanaged configuration requires doas makepf reload --adopt. MakePF keeps a backup of the previous /etc/pf.conf.
The router walkthrough covers interface setup, DHCP, DNS and router advertisements alongside MakePF.
A DutchBSD project
MakePF is maintained by DutchBSD B.V. under the BSD 2-Clause License. Report an issue or contact DutchBSD for help.