# pf (OpenBSD Packet Filter)

53 Hacker News commenters recommended pf (OpenBSD Packet Filter) and 7 criticized it, November 2025 to November 2026. It was recommended in 11 of 13 months. It meets the Hacker Approved badge rule.

**Verdict:** Recommended for its readable configuration syntax, simplicity and reliability; critics cite single-threaded performance and syntax changes that break configs.

## Why people recommend it

- Readable, intuitive configuration syntax (10 comments): "That firewall config is just easy to grok, easy to read up on and does 99.999% of what you ever need out of a firewall." ([source](https://news.ycombinator.com/item?id=46110070)) "It's easy to configure and still human readable, even for more advanced firewall gateway setups" ([source](https://news.ycombinator.com/item?id=46309886)) "pretty much the most well regarded firewall there is - with a nice, sensible DSL for config" ([source](https://news.ycombinator.com/item?id=45793266))
- Very capable firewall (4 comments): "That firewall config is just easy to grok, easy to read up on and does 99.999% of what you ever need out of a firewall." ([source](https://news.ycombinator.com/item?id=46110070)) "It's just a very capable firewall with a pleasurable configuration language." ([source](https://news.ycombinator.com/item?id=46038477)) "Whatever a firewall can do, PF can do it." ([source](https://news.ycombinator.com/item?id=48472111))
- Simple and reliable (3 comments): "I prefer pf and the simplicity of OpenBSD over Debian for such a purpose-built application" ([source](https://news.ycombinator.com/item?id=45945575)) "hands down my favorite combination for simple packet filter firewalls" ([source](https://news.ycombinator.com/item?id=46001827)) "it is used widely for its simplicity and reliability" ([source](https://news.ycombinator.com/item?id=47443422))
- Integrates well with OpenBSD tools (2 comments): "Playing with jails, pf, ZFS, and some other goodies has been a lot of fun." ([source](https://news.ycombinator.com/item?id=45794431)) "Jails, ZFS, pf, bhyve, Dtrace are very well integrated with eachother" ([source](https://news.ycombinator.com/item?id=46104518))

## What people warn about

- Single-threaded performance limits (4 comments): "the single threaded nature killed it for any serious usage for me" ([source](https://news.ycombinator.com/item?id=46042567)) "the miserable single-threaded `pf` on OpenBSD is still" ([source](https://news.ycombinator.com/item?id=46043674)) "pf leaves performance on the table" ([source](https://news.ycombinator.com/item?id=47443963))
- Breaking rule syntax changes (3 comments): "The easiest change to make to pf is making BC breaks to everyone’s firewall config which OpenBSD has done multiple times." ([source](https://news.ycombinator.com/item?id=46649493)) "OpenBSD changed the rules syntax for some reason and the other platforms with pf kept the existing syntax" ([source](https://news.ycombinator.com/item?id=47532861)) "has blessed breaking pf multiple times by changing the rule syntax" ([source](https://news.ycombinator.com/item?id=46846594))
- Dislike of rule syntax (2 comments): "Personally, I don't really care for PF, but it offers pfsync, which I do care for, so I use it" ([source](https://news.ycombinator.com/item?id=46038566)) "I also don't really care for how pf specifies rules" ([source](https://news.ycombinator.com/item?id=47444443))

## Alternatives hackers recommend

- [nftables](https://hackerapproved.com/p/nftables.md): 29 recommend
- [LuLu firewall](https://hackerapproved.com/p/lulu.md): 27 recommend
- [iptables](https://hackerapproved.com/p/iptables.md): 15 recommend
- [UFW](https://hackerapproved.com/p/ufw.md): 12 recommend
- [firewalld](https://hackerapproved.com/p/firewalld.md): 11 recommend

## Cite as

Hacker Approved, "pf (OpenBSD Packet Filter)", https://hackerapproved.com/p/pf/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).