Extended Discussion: The Role of Packet Filter and IPFW in Firewall Filtering

[hsing]

I would like to continue the discussion I had in this forum thread.

In that discussion, I learned that Packet Filter cannot filter Layer 2 packets, so I conducted further testing. I found that if the ARP table lacks corresponding IP and MAC entries, the firewall will block those packets. However, if the ARP table already has these records, the firewall filters the packets according to the rules.

It was also mentioned that using IPFW for Layer 2 filtering is easier to achieve, which I also tested. I modified /boot/loader.conf to ensure that Packet Filter loads after IPFW (although I initially intended to disable Packet Filter, it still started for some reason). In practice, filtering using IPFW was successful.

However, I’m curious why not use IPFW directly for all firewall rule filtering? Is there any information that explains why PF is considered more suitable for this task than IPFW?

These questions come from my limited experience, so if there are any mistakes, I welcome corrections. Thank you!