OpenBSD 7.6 as a Network Firewall: The Gold Standard

OpenBSD has maintained its legendary security track record. With only two remote holes in the default install in over 28 years, it remains unmatched for security-critical deployments. This guide covers a production-ready PF firewall configuration.

Why OpenBSD Over Linux for Firewalls

OpenBSD includes W^X memory protection, stack protector, ASLR, LibreSSL (a hardened OpenSSL fork), and pledge/unveil syscall restrictions — all enabled by default. No kernel modules to exploit, minimal attack surface.

PF Firewall Configuration

# /etc/pf.conf — Production OpenBSD 7.6
ext_if = "em0"
int_if = "em1"
table <bruteforce> persist
block all
pass in quick on lo0 all
# Block brute force
block quick "kw">from <bruteforce>
pass in on $ext_if proto tcp to port 443 modulate state
pass in on $ext_if proto tcp to port 22 
    flags S/SA keep state 
    (max-src-conn 3, max-src-conn-rate 3/60, 
     overload <bruteforce> flush global)