Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hi how to is possible to convert iptables rules into pf rules file?

share|improve this question
Are you talking about Pfsense? – Jacob Jan 28 '11 at 21:27

One method would be to use the application FWBuilder. It is primarily a graphical application that can be used to manage firewall rule sets. It also, however, has an import/export feature that can be used to translate between different firewall types. And yes, both iptables and pf are supported.

So it looks like FWBuilder is more tricksome than I remembered. While you can import rulesets from Cisco and IPTables, you cannot directly export. I went through the process of translating a desktop IPTables ruleset from iptables to pf, and it was a fair amount of effort. Whether it is easier than learning pf syntax and doing a manual conversion, I don't know. That being said, this is the process I took to go from iptables -> pf using fwbuilder.

  1. File -> Import Policy -> Select iptables rule file
  2. Set Platform = iptables, click Next
  3. Change New Firewall type to pf with appropriate Version and Host OS settings NewFirewall-EditFirewallSettings
  4. Create new Interface object AddNewInterface
  5. Change Direction in Policy frame to their correct direction (inbound/output/both)
  6. Add newly created interface to rules where appropriate
  7. Save to FWBuilder format -- File -> Save As -> Select filename to save as

From this point I used an iterative process to filter out any parse problems that fwbuilder had, primiarily the direction issues above and things like my rule to drop XMAS packets. I did this by issuing the compile commands directly, instead of using the interface.

  1. fwb_pf -v -f ~/sandbox/firewallwork/desktop_firewall -d ~/sandbox -o ~/sandbox/firewallwork/New\ Firewall.fw 'New Firewall'
  2. If no errors, stop, else
  3. Fix problem in interface
  4. File -> Save
  5. goto 1

This will, eventually, leave you with two files that contain your new pf firewall config, New Firewall.fw, and New Firewall.conf. To reiterate above, after refreshing my memory on the process I am a lot less excited about it as a truly useful solution. However, by comparing the output beside your original ruleset it may help you get a better understanding of how the pf rulesets are developed so you can start managing them yourself.

share|improve this answer
How to import I see, but there is't clear how export? – MBM Jan 28 '11 at 21:53
Admittedly, I cheaped out with the answer. I'll try to update with better instructions (and maybe screenshots) later when I have more time. – Scott Pack Jan 28 '11 at 21:55
Import current iptables rules (fwbuilder can import only iptables and cisco ACL rules), change firewall type to PF, press "Compile" button. – gelraen Jan 28 '11 at 23:29

Assuming your talking about Pfsense. No, this isn't possible, you'll have to enter them by hand.

share|improve this answer
pf is the OpenBSD software firewall. pfSense, being FreeBSD, uses pf for the firewall portion of the distro. – Scott Pack Jan 28 '11 at 21:30
well my reply is most likely wrong then... Please move along, noting to see here... – Jacob Jan 28 '11 at 21:32
I think you're spot on either way -- the OP will need to conceptualize the rules and translate them from iptables syntax to pf syntax. As far as I know there's no tool that does this. – voretaq7 Jan 28 '11 at 21:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.