Hi how to is possible to convert iptables rules into pf rules file?

  • Are you talking about Pfsense? – Jacob Jan 28 '11 at 21:27

One method would be to use the application FWBuilder. It is primarily a graphical application that can be used to manage firewall rule sets. It also, however, has an import/export feature that can be used to translate between different firewall types. And yes, both iptables and pf are supported.

So it looks like FWBuilder is more tricksome than I remembered. While you can import rulesets from Cisco and IPTables, you cannot directly export. I went through the process of translating a desktop IPTables ruleset from iptables to pf, and it was a fair amount of effort. Whether it is easier than learning pf syntax and doing a manual conversion, I don't know. That being said, this is the process I took to go from iptables -> pf using fwbuilder.

  1. File -> Import Policy -> Select iptables rule file
  2. Set Platform = iptables, click Next
  3. Change New Firewall type to pf with appropriate Version and Host OS settings NewFirewall-EditFirewallSettings
  4. Create new Interface object AddNewInterface
  5. Change Direction in Policy frame to their correct direction (inbound/output/both)
  6. Add newly created interface to rules where appropriate
  7. Save to FWBuilder format -- File -> Save As -> Select filename to save as

From this point I used an iterative process to filter out any parse problems that fwbuilder had, primiarily the direction issues above and things like my rule to drop XMAS packets. I did this by issuing the compile commands directly, instead of using the interface.

  1. fwb_pf -v -f ~/sandbox/firewallwork/desktop_firewall -d ~/sandbox -o ~/sandbox/firewallwork/New\ Firewall.fw 'New Firewall'
  2. If no errors, stop, else
  3. Fix problem in interface
  4. File -> Save
  5. goto 1

This will, eventually, leave you with two files that contain your new pf firewall config, New Firewall.fw, and New Firewall.conf. To reiterate above, after refreshing my memory on the process I am a lot less excited about it as a truly useful solution. However, by comparing the output beside your original ruleset it may help you get a better understanding of how the pf rulesets are developed so you can start managing them yourself.

  • How to import I see, but there is't clear how export? – MBM Jan 28 '11 at 21:53
  • Admittedly, I cheaped out with the answer. I'll try to update with better instructions (and maybe screenshots) later when I have more time. – Scott Pack Jan 28 '11 at 21:55
  • Import current iptables rules (fwbuilder can import only iptables and cisco ACL rules), change firewall type to PF, press "Compile" button. – gelraen Jan 28 '11 at 23:29

Assuming your talking about Pfsense. No, this isn't possible, you'll have to enter them by hand.

  • 3
    pf is the OpenBSD software firewall. pfSense, being FreeBSD, uses pf for the firewall portion of the distro. – Scott Pack Jan 28 '11 at 21:30
  • well my reply is most likely wrong then... Please move along, noting to see here... – Jacob Jan 28 '11 at 21:32
  • 2
    I think you're spot on either way -- the OP will need to conceptualize the rules and translate them from iptables syntax to pf syntax. As far as I know there's no tool that does this. – voretaq7 Jan 28 '11 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.