For packet rule testing, legacy 5 tuple based techniques employ decision tree, decomposition or hardware (usually TCAM) based approaches. What specific technique do pfSense firewalls employ to test the packets against the rules with minimal hardware requirements. As the rules are defined usually by 5 tuple for IPv4, a firewall has to match each incoming packet and transport header fields against the stored rule set. How does a firewall decide which rule an incoming packet is matched to either pass or to block and also maintain line-rate?

  • 1
    Packets are classified using the DSCP (IPv4) or Traffic Class (IPv6) field in the packet header. – Ron Maupin Jun 3 '20 at 23:32
  • I will edit the question as my question was about how firewall decide which rule an incoming packet is matched to decide either to pass or to block (drop) it. As the rules are defined usually by 5 tuple for ipv4, firewall has to match each incoming packet header fields against the stored ruleset. How it does that (maintaining line rate) was my question @RonMaupin – H.Jamil Jun 4 '20 at 5:57
  • Yes, that is a very different question. You are really asking how a firewall applies its rulles to the traffic, not packet classification. – Ron Maupin Jun 4 '20 at 6:00
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer. – Ron Maupin Dec 31 '20 at 19:41

pfSense is a open-source software firewall, so the most obvious answer for how they do it is "take a look at the source code". Programming techniques are off-topic here anyway.

Being a software firewall, pfSense doesn't require special hardware like ASICs or TCAM. It can use offloading functions provided by the NIC but that's about it. So it's all about code efficiency.

A hardware-based firewall can make heavy use of TCAM, enabling very efficient table lookups. ASICs can further speed up more complex processing.

Given the speed of a good CPU, a software-based approach can provide excellent throughput and overall performance, but a hardware-based firewall can probably still have superior latency.


If packet souce ip address , destination ip address , service ports, application id matches against the policy framed in firewall and further check for route entry . if its matches with firewall configuration packet is allowed by firewall toward outside to inside network and inside to outside networks .

If above parameters are not matching then firewall will simply drops the packet with the reference to clean up rule .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.