tag
6 posts
New connections start silently failing on a busy firewall, and pfctl reports the state table is full. Here's how to confirm it and size the table correctly for real traffic levels.
Using the same BSD packet filter that powers macOS's Application Firewall directly, for network-layer filtering the GUI's simple allow/deny-per-app model can't express.
The layered, extensible packet-filtering architecture introduced in Windows Vista that both Windows Firewall and most third-party security software actually build on, rather than each implementing separate low-level network hooks.
How pf's rule evaluation model, tables, and anchors fit together on FreeBSD, with a ruleset you can adapt for a real host.
A complete, working nftables ruleset for a typical server — default-deny inbound, stateful connection tracking, and a handful of explicit allowed services.
A complete walkthrough creating specific, scoped inbound and outbound rules with PowerShell, rather than the common mistake of just disabling the firewall entirely.