The Book of PF, 3rd Edition A No-Nonsense Guide to the OpenBSD Firewall (Peter N. M. Hansteen)（Z-Library）

【One-Line Pitch】 A practical, example-driven guide to building real networks with OpenBSD's PF packet filter—from a single machine to gateways, DMZs, wireless, and failover—for sysadmins who want secure, well-shaped traffic without hand-waving. 【Book Arc】 - **Opening (~0%–10%)**: Frames PF as the kernel-level heart of the OpenBSD firewall and sets expectations—firewalling, NAT, traffic control, and bandwidth management in one system—while orienting newcomers to the BSD way of working. - **Early (~10%–32%)**: Builds the foundation: enabling PF with `pfctl`, writing a minimal single-machine rule set (`block in all` / `pass out all keep state`), and understanding that filtering is only one of several uses for packet criteria. - **Middle (~32%–48%)**: Extends the single-machine setup into a gateway for a home or small office, introducing macros like `$localnet` for readable rule sets and handling awkward services such as FTP via `ftp-proxy`. - **Late (~48%–70%)**: Moves into trickier territory—wireless with authpf access control, DMZs and multiple subnets, redirection and relayd load balancing, and proactive defense against brute-force and spam (spamd). - **Ending (~70%–100%)**: Covers traffic shaping with the queues-and-priorities system (replacing ALTQ), plus monitoring/visualization and failover provisioning with CARP—rounding out operations beyond basic filtering. (Excerpts do not detail the final chapters' internals.) 【Key Takeaways】 - **PF is more than a blocker** (Early): Filtering criteria can redirect traffic to hosts, assign it to queues, shape bandwidth, or hand it to other software—so treat the rule set as a traffic policy, not just a deny list. - **Start minimal, then grow** (Early): The book deliberately begins with the simplest possible rule set on a standalone machine, because every later configuration builds on that baseline; skipping ahead makes later chapters harder. - **Macros make rule sets maintainable** (Middle): Defining `$localnet`, `$ports`, and similar macros shrinks rule sets and makes logic legible—crucial for long-term upkeep and auditing. - **Document policy before converting** (Early): Hansteen urges resisting automated conversion from other firewall products; instead re-specify your network's goals in prose (or config comments) and implement those policies in PF. - **Awkward protocols need special handling** (Middle): FTP and similar services require helpers like `ftp-proxy` and careful pass rules—an early lesson that "just open the port" often isn't enough. - **Defense can be proactive** (Late): Tools like spamd and rate-limiting against brute-force attempts turn the firewall into an active defender, making the network friendlier to legitimate users. - **Traffic shaping is a first-class concern** (Late): The queues-and-priorities system (post-ALTQ) keeps networks responsive under load—bandwidth management belongs in your PF design, not as an afterthought. - **Availability and visibility matter** (Late): CARP, relayd, and monitoring/NetFlow-style tooling extend PF from a perimeter device into a resilient, observable network component. 【Reading Tips】 - **Deep-read Chapters 2–3**: the single-machine and gateway configurations are the load-bearing foundation; type out and test each rule set rather than skimming. - **Skim the BSD-orientation material** if you already run OpenBSD/FreeBSD/NetBSD, but don't skip the `pfctl` enable/load workflow—it recurs throughout. - **Treat FTP, wireless, and spamd sections as pattern libraries**: read them when your network actually needs them, and consult the referenced man pages for edge cases. - **Watch version drift**: the book targets OpenBSD 5.6, FreeBSD 10.x, and NetBSD 6.x; verify syntax against current man pages, especially for queues/priorities and ALTQ migration. - **Keep a written policy alongside your config**: follow the author's advice and comment your rules—future-you will thank present-you. 【Coverage Limits】 This guide is synthesized from stratified excerpts covering roughly the first half of the book plus front matter; later chapters on queues, monitoring, and failover are represented only by their stated themes, so specifics there are not covered.