MakePF

Synopsis

MakePF compiles zone-based firewall configuration into native OpenBSD PF rules. Zones name the networks; policies and rules describe which connections may pass between them. The generated ruleset can be reviewed with standard PF tools.

MakePF is for OpenBSD. It requires Python 3.11 or later and uses only the Python standard library. Checking and compiling run without root privileges. On the OpenBSD router, reload validates, loads and saves the ruleset for reboot. Interface setup and other network services remain OpenBSD tasks.

Install

Install the system command to manage PF on an OpenBSD router. Python and Git are packages, separate from OpenBSD base. The following steps require an account with administrative access through doas.

Install prerequisites

The commands below use Python 3.14. If your OpenBSD release provides another Python 3.11 or later version, use its package flavor and versioned executable instead.

doas pkg_add python%3.14 git

Get the source

Clone the repository and enter its directory:

git clone https://github.com/dutchbsd/makepf.git
cd makepf

Build and install

From the cloned makepf directory, build the executable archive and install it as the root-owned system command:

/usr/local/bin/python3.14 tools/build.py
doas install -o root -g bin -m 755 dist/makepf /usr/local/bin/makepf
makepf --version

Example output

MakePF 1.0.1

The archive uses the Python interpreter that built it. Keep that interpreter installed; no third-party Python libraries or build tools are required.

Optional personal installation

For unprivileged checks and compilation, install MakePF with pipx:

doas pkg_add py3-pipx
pipx ensurepath

Open a new terminal, then install MakePF as the regular user:

pipx install --python /usr/local/bin/python3.14 makepf

A personal installation can check and compile configurations alongside the system installation. The doas rules below select the root-owned system command for reloads. Do not run a personal Python environment as root.

First configuration

Continue from the cloned makepf directory. On a new installation, copy the dual-stack example into the default configuration directory:

doas install -d -o root -g wheel -m 755 /etc/makepf
doas install -o root -g wheel -m 644 examples/dual-stack/* /etc/makepf/

Edit the interface names and network prefixes for the router:

doas vi /etc/makepf/interfaces

Review policy, rules, nat, forwards and settings in the same directory. The router walkthrough explains the network prerequisites and the purpose of each file. Keep the configuration root-owned and unwritable by other users.

Enable administrative reloads

Edit /etc/doas.conf with your existing administrator access:

doas vi /etc/doas.conf

Add these rules after any broader rules for wheel:

permit persist :wheel as root cmd makepf args reload
permit persist :wheel as root cmd makepf args reload --adopt

These command-specific rules use OpenBSD's system search path. This lets doas makepf reload use /usr/local/bin/makepf even when a personal installation comes first in the user's PATH. See doas.conf(5).

Check and load

Check the configuration as the regular user:

makepf check

On OpenBSD, this also checks the generated rules with native pfctl. To inspect the rules before loading them, run makepf compile | less.

The first reload replaces the existing /etc/pf.conf. Review the policy and retain console access before adopting it:

doas makepf reload --adopt

MakePF retains the previous file as /etc/pf.conf.makepf.bak. Once /etc/pf.conf is managed by MakePF, the normal workflow is:

makepf check
doas makepf reload

reload always repeats validation before changing PF. It preserves existing states and does not enable PF or configure interfaces. See the configuration reference for reload failure handling and optional directory arguments.

Configuration example

In the policy file, this permits connections initiated from the local network to the external network and drops other connections:

# SOURCE  DESTINATION  FAMILY  ACTION
loc       net          both    ACCEPT
all       all          both    DROP

In the rules file, this permits SSH from the local network to the firewall:

# ACTION  SOURCE  DESTINATION  FAMILY  PROTOCOL  SERVICE
ACCEPT    loc     fw           both    tcp       22

fw names the firewall zone. Replies to permitted connections are stateful; reverse rules are unnecessary for replies. Columns use spaces for alignment; see editing configuration files.

Documentation

• Configuration reference: files, selectors and ordering.
• Router walkthrough: reference IPv4 routers and a dual-stack configuration, including differences from the source guides.
• Architecture: packet model and compiler boundaries.
• Contributing: development, formatting and verification.

MakePF's configuration is inspired by Shorewall's separation of zones, policies and exceptions. It is an independent language, not a Shorewall-compatible implementation. PF is the only output target. Interface setup, DHCP, DNS, router advertisements and prefix acquisition remain separate OpenBSD tasks.

License

Copyright © 2026 DutchBSD B.V.. Distributed under the BSD 2-Clause License.