PF on Linux
Port of the OpenBSD PF (packet filter) to Linux 7.3.4 as out-of-tree
kernel modules — the real PF engine (pf.c, pf_norm.c, pf_table.c,
pf_lb.c, … ported from OpenBSD 8.0 sources) driven by the real OpenBSD
pfctl over the /dev/pf ioctl ABI.
Status: implementation in progress — see
docs/superpowers/plans/2026-11-11-pf-linux-port.md
for task progress and
docs/superpowers/specs/2026-11-11-pf-linux-port-design.md
for the design.
What you get (planned)
| Area | Feature |
|---|---|
| Filtering | rules, anchors, quick, match/block(drop/return/return-rst)/pass, keep state, syncookies |
| State/Tables | stateful firewall engine, pfr tables (radix + hash, pfctl -t) |
| NAT | nat-to (port pools, sticky-port, static-port), rdr-to, binat-to |
| Scrub | fragment reassembly, overlap drop, min-ttl/max-mss/df/no-df, set reassemble |
| QoS (ALTQ successor) | queue/queue on with OpenBSD 8.0 ifq schedulers: default (priq), HFSC, FQ-CoDel, attached via the pfq qdisc; pfctl -s queue -v stats |
| Divert | divert-to / divert tag + pdivert userspace channel (netlink; Linux has no AF_DIVERT) |
| Route | route-to (pools rr/hash-source/hash-state, fail-to), reply-to, dup-to |
| Logging | pflogd via netlink pflog channel (DLT_PFLOG pcap) |
| Control | /dev/pf (0600), OpenBSD 8.0 ioctl ABI, Linux build of pfctl (single binary) |
Not in scope: pfsync/CARP failover, IPsec/pfkey, ftp-proxy, per-netns PF
instances, classic-ALTQ-only schedulers (cbq/wfq/red — removed upstream before
OpenBSD 8.0).
Quick start (after M1+)
./scripts/fetch-sources.sh # OpenBSD 8.0 sources (C3SL mirror, checksummed)
./scripts/apply-patches.sh ../linux-7.3.4 # core export patch(es)
make module tools # pf.ko, pfq.ko, pfctl, pdivert, pflogd
sudo insmod module/pf.ko module/pfq.ko
sudo pfctl -f /etc/pf.conf && sudo pfctl -e
VM validation lab (Alpine on libvirt): see docs/en/vm-lab.md.
Documentação em português: README.pt-BR.md e docs/pt-BR/.
Layout
module/— kernel sources (ported PF + compat layer + pfq qdisc)tools/— pfctl/pdivert/pflogd Linux buildspatches/kernel/— documented Linux core patches (export symbols only)scripts/— fetch/build/patch/VM automationtests/— VM suite (tests/vm/NN-*.sh, scapy helpers)docs/en/+docs/pt-BR/— full bilingual documentationdocs/superpowers/— design spec + implementation plan
License
Ported OpenBSD code retains its original ISC license and copyright notices. New Linux-side code: ISC.